Overview

overview

10

Static

static

3

e78cf21e55...ec.exe

windows7-x64

10

e78cf21e55...ec.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    118s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    28-12-2023 15:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e78cf21e556c3092fd4fd69502d5afec.exe

  • Size

    172KB

  • MD5

    e78cf21e556c3092fd4fd69502d5afec

  • SHA1

    6e07a503ed35db15fe4abe554c262b352e65856a

  • SHA256

    b228ab1c794a255e2b655e4f559f60d0f727125e33038a1f717fd50dc978c1d1

  • SHA512

    09fa20c2527f67a040d8e47e9a7a3c05ab9893e46c749de7232c3bdabfc62ba51fac93f8da9f70f5970aae058f05360aef8f2de52fa4291485fa9bc45812668f

  • SSDEEP

    3072:FiHCy8NpD2VLKivsvnzmsJTUFAUFUd+0JgkibU4jLj8VgRCiyz+Qd3yoWZzb:AHCygULKUsbHJTUFOd+0etbrLj8VfrEo

Score
10/10

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1260
      • C:\Users\Admin\AppData\Local\Temp\e78cf21e556c3092fd4fd69502d5afec.exe
        "C:\Users\Admin\AppData\Local\Temp\e78cf21e556c3092fd4fd69502d5afec.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2452

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2452-0-0x0000000000B50000-0x0000000000B82000-memory.dmp
      Filesize

      200KB

      Download
    • memory/2452-1-0x000007FEF57E0000-0x000007FEF61CC000-memory.dmp
      Filesize

      9.9MB

      Download
    • memory/2452-2-0x000000001A690000-0x000000001A710000-memory.dmp
      Filesize

      512KB

      Download
    • memory/2452-3-0x000007FEF57E0000-0x000007FEF61CC000-memory.dmp
      Filesize

      9.9MB

      Download