Analysis
-
max time kernel
15s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30-12-2023 16:56
Static task
static1
Behavioral task
behavioral1
Sample
02a6ec40adc5114071950b305a7dad31.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
02a6ec40adc5114071950b305a7dad31.exe
Resource
win10v2004-20231215-en
General
-
Target
02a6ec40adc5114071950b305a7dad31.exe
-
Size
483KB
-
MD5
02a6ec40adc5114071950b305a7dad31
-
SHA1
2d4704843149608a649b19bb6d0ddcd25a8ffe45
-
SHA256
3c63f0da1a6f07ac40a85a614caef3d4b5edb022869d30385e59282576db579c
-
SHA512
d30d11be7a6362603957f1d05ef11c97185b61b87e947028729bb4f28e673a777fb777eb9704039b0c1b1a333c61278a0f70492aebd524a9aa9e6c2646eb1fcb
-
SSDEEP
6144:AIFhuSYWFYgrKsUc3y2WnO1xzcWmZXe2rkwnbo60T21BOcCSrYDEgfje5ig1ef9B:th8Mz+sv3y2N1xzAZprkmuN/SD5iKefz
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
02a6ec40adc5114071950b305a7dad31.exedescription pid process Token: SeDebugPrivilege 2156 02a6ec40adc5114071950b305a7dad31.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\02a6ec40adc5114071950b305a7dad31.exe"C:\Users\Admin\AppData\Local\Temp\02a6ec40adc5114071950b305a7dad31.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\02a6ec40adc5114071950b305a7dad31.exe" "C:\Users\Admin\AppData\Local\syscheck.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Local\syscheck.exe"2⤵
-
C:\Users\Admin\AppData\Local\syscheck.exe"C:\Users\Admin\AppData\Local\syscheck.exe"3⤵
-
C:\Users\Admin\AppData\Local\syscheck.exe"C:\Users\Admin\AppData\Local\syscheck.exe"4⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"1⤵
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\syscheck.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/436-23-0x00000000747E0000-0x0000000074F90000-memory.dmpFilesize
7.7MB
-
memory/436-18-0x0000000005660000-0x0000000005670000-memory.dmpFilesize
64KB
-
memory/436-17-0x00000000747E0000-0x0000000074F90000-memory.dmpFilesize
7.7MB
-
memory/436-19-0x0000000006290000-0x000000000632C000-memory.dmpFilesize
624KB
-
memory/436-16-0x0000000005660000-0x0000000005670000-memory.dmpFilesize
64KB
-
memory/436-15-0x00000000747E0000-0x0000000074F90000-memory.dmpFilesize
7.7MB
-
memory/540-33-0x0000000000A90000-0x0000000000AA2000-memory.dmpFilesize
72KB
-
memory/540-37-0x0000000000A90000-0x0000000000AA2000-memory.dmpFilesize
72KB
-
memory/540-38-0x0000000000840000-0x000000000086A000-memory.dmpFilesize
168KB
-
memory/540-39-0x0000000002860000-0x0000000002BAA000-memory.dmpFilesize
3.3MB
-
memory/540-35-0x0000000000A90000-0x0000000000AA2000-memory.dmpFilesize
72KB
-
memory/540-40-0x00000000025A0000-0x0000000002633000-memory.dmpFilesize
588KB
-
memory/540-46-0x0000000000840000-0x000000000086A000-memory.dmpFilesize
168KB
-
memory/2156-14-0x00000000747E0000-0x0000000074F90000-memory.dmpFilesize
7.7MB
-
memory/2156-9-0x0000000004CF0000-0x0000000004D00000-memory.dmpFilesize
64KB
-
memory/2156-0-0x0000000000100000-0x000000000017E000-memory.dmpFilesize
504KB
-
memory/2156-3-0x0000000004B50000-0x0000000004BE2000-memory.dmpFilesize
584KB
-
memory/2156-5-0x0000000004CF0000-0x0000000004D00000-memory.dmpFilesize
64KB
-
memory/2156-1-0x00000000747E0000-0x0000000074F90000-memory.dmpFilesize
7.7MB
-
memory/2156-4-0x0000000004BF0000-0x0000000004C0C000-memory.dmpFilesize
112KB
-
memory/2156-2-0x00000000051E0000-0x0000000005784000-memory.dmpFilesize
5.6MB
-
memory/2156-8-0x00000000747E0000-0x0000000074F90000-memory.dmpFilesize
7.7MB
-
memory/2820-20-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/2820-30-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/2820-31-0x00000000012B0000-0x00000000012C4000-memory.dmpFilesize
80KB
-
memory/2820-26-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/2820-24-0x0000000001410000-0x000000000175A000-memory.dmpFilesize
3.3MB
-
memory/2820-27-0x00000000011F0000-0x0000000001204000-memory.dmpFilesize
80KB
-
memory/3416-32-0x0000000002C60000-0x0000000002D1F000-memory.dmpFilesize
764KB
-
memory/3416-28-0x0000000008840000-0x00000000089BA000-memory.dmpFilesize
1.5MB
-
memory/3416-42-0x00000000089C0000-0x0000000008A5A000-memory.dmpFilesize
616KB
-
memory/3416-43-0x00000000089C0000-0x0000000008A5A000-memory.dmpFilesize
616KB
-
memory/3416-44-0x0000000002C60000-0x0000000002D1F000-memory.dmpFilesize
764KB
-
memory/3416-48-0x00000000089C0000-0x0000000008A5A000-memory.dmpFilesize
616KB