Analysis
-
max time kernel
136s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
29/12/2023, 21:06
General
-
Target
0405f0b1fefb34121b35842e2d681e60.exe
-
Size
101KB
-
MD5
0405f0b1fefb34121b35842e2d681e60
-
SHA1
0b8ea0374f710d4954bfe27e9feb03fd2fc6f1e4
-
SHA256
74d1b9f987ab230caa57662ed7b3c566e592a4d99b8bc3c65dc87dcff2bb8513
-
SHA512
c0ad95df2d157d26cba40bf12e2e086bf091b2665ad03da35695932a62e776f57bc9dcb96ad8f2eaa4e73d730ee5f38f37bcd6233fd25d1e4a7af90c4f896599
-
SSDEEP
1536:v+6I867HUAptrFqpDVoXF0AOYzZIr4nuerbDbQIusErNuYjR4Hlqs:v+6IpDUApGpho1uMZYEuW/83
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0405f0b1fefb34121b35842e2d681e60.exe"C:\Users\Admin\AppData\Local\Temp\0405f0b1fefb34121b35842e2d681e60.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\CbEvtSvc.exeC:\Windows\SysWOW64\CbEvtSvc.exe -k netsvcs1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
101KB
MD50405f0b1fefb34121b35842e2d681e60
SHA10b8ea0374f710d4954bfe27e9feb03fd2fc6f1e4
SHA25674d1b9f987ab230caa57662ed7b3c566e592a4d99b8bc3c65dc87dcff2bb8513
SHA512c0ad95df2d157d26cba40bf12e2e086bf091b2665ad03da35695932a62e776f57bc9dcb96ad8f2eaa4e73d730ee5f38f37bcd6233fd25d1e4a7af90c4f896599
-
Filesize
79KB
MD597dc8630a40d88fdbe23edc76c0280b1
SHA1b3ad3d077ef5d6d887a9a6a9bc1885b276503480
SHA256afd0e7da705ff5e26662bd5abd433dcad59564ff63250ba3c62f84983858d79d
SHA51208f215d4456abae5cc22b745915c3eb600b5a0465381fa02203cac8ecfa2e2d1388de391ea95094c31343ea070dbf42408c6d04fa9959532571f8c0f231fd207
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
88KB
-
Filesize
136KB
-
Filesize
88KB
-
Filesize
136KB
-
Filesize
136KB