60ea7fc78d4db83ab17674ae41a98d19d000bb939248dd5bd6f12524877a3d42

Analysis

max time kernel
0s
max time network
50s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 22:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

061690006fccf0d52bf47e8a142a31c9.exe
Size

1.4MB
MD5

061690006fccf0d52bf47e8a142a31c9
SHA1

3343a6d20da69c74643fa9af14b3b784bdeb20f8
SHA256

60ea7fc78d4db83ab17674ae41a98d19d000bb939248dd5bd6f12524877a3d42
SHA512

5ece061a2ad25ec2ddd294302b4a97517e5010af6c13bd38acd6aae72cdaf92abd0cca0610e81d713bc6511c4490397f9bfca3b3aaab4280d56a7dfc84401233
SSDEEP

24576:3utr5OULQaKYOAa/Q7lhRugqqnMx5OKASgL7sg1MMbo3O5X1UhmA7Ji1BWYk:3uXJx9C8PggXMx5OKmQxMbo3OtawAdie

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1532	061690006fccf0d52bf47e8a142a31c9.exe
Token: SeRestorePrivilege	1532	061690006fccf0d52bf47e8a142a31c9.exe

C:\Users\Admin\AppData\Local\Temp\061690006fccf0d52bf47e8a142a31c9.exe
"C:\Users\Admin\AppData\Local\Temp\061690006fccf0d52bf47e8a142a31c9.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1532
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\bin\bstrapInstall.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\bin\bstrapInstall.exe"
  2⤵
  PID:1724

C:\Users\Admin\AppData\Local\Temp\RarSFX0\bin\gameinstaller.exe
.\bin\gameinstaller.exe installerMain.clf
1⤵
PID:5116

C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\system32\regsvr32 /s .\bin\InstallerDlg.dll
1⤵
PID:5044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\bin\InstallerDlg.dll

Filesize
92KB

MD5
05d59627e6f4eee3d92334afbb97a7ed

SHA1
9ded319b6de8251a67fd07d7ba33a05a546fd633

SHA256
3b8a9c22e2098dd419c9ad2a7d811b3999e87f86dfef08fbcad4c07657cd2d33

SHA512
01fa6187e37cd864ac69a7d44bab673adad3ce44f6629360558d4ea2dd8061109fa6db1562abbc0a9fda98d160eb6723c38d92cbc4ba9e6c0028a2b3ea9cf7ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\bin\bstrapinstall.exe

Filesize
39KB

MD5
94c760428c74f4059f6c141ecdf1a9ca

SHA1
064079417435628b8d8e6454c8871d4b65c3063e

SHA256
9a0bd3a1316026e7998b092f33ba326395a427ba61d7eec58d69c807c666b52b

SHA512
ddb1ff27b935117e07672d7d60e0b3f714f9b6984e526c186c0b707e52ea086fb4ab333aff1ef4091f1cceb2bd4e598b7c8c0470f4ad6287f2218535522cc902

Download Submit
memory/5116-158-0x0000000002560000-0x000000000256A000-memory.dmp

Filesize
40KB

Download
memory/5116-149-0x00000000005C0000-0x00000000005E4000-memory.dmp

Filesize
144KB

Download