Analysis
-
max time kernel
195s -
max time network
206s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30/12/2023, 00:19
General
-
Target
0851a2514cd1d5077e3d6a2f4021405b.exe
-
Size
174KB
-
MD5
0851a2514cd1d5077e3d6a2f4021405b
-
SHA1
7c0185554579f2ff59f03a615f1adc110c9cdd2f
-
SHA256
6f096b5195b0dd607eff8e19d99eba4725795a4a2bf38a6690c323d55b629eeb
-
SHA512
8efa13ac52f21987157400f0d83fc9bbf09aa114e802549394b4f0944b6a1f859e583c0e64c92cfb49b998486e05b18ccec47509335e3c371c2f0e922661c3c4
-
SSDEEP
3072:Ii5gRyVDeI1Br7yDi2eWbhfRE+7AwVqnq83ABZBR82fom7xw4AOfnk+v/843P:55QyVDefUYlRLqn1QBR82Q8yCnkYp
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0851a2514cd1d5077e3d6a2f4021405b.exe"C:\Users\Admin\AppData\Local\Temp\0851a2514cd1d5077e3d6a2f4021405b.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
492KB
-
Filesize
8KB
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
4KB
-
Filesize
492KB
-
Filesize
8KB
-
Filesize
492KB