dea7b64b5faf84fda767373caa41c5b9c22df730806ee134c20aa2fc15db78d5

Analysis

max time kernel
145s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 00:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

223813ceb88edbfde22d82ebb222db6c.exe
Size

685KB
MD5

223813ceb88edbfde22d82ebb222db6c
SHA1

71ca083274c34312b666989684922c680fe5524d
SHA256

dea7b64b5faf84fda767373caa41c5b9c22df730806ee134c20aa2fc15db78d5
SHA512

9bb15b2b83fbb2fae6a7bd6e2f833f740ce961c4906616e49bace0823ddf79d68cee15c3b416607377753dae218dba81787ac6a7b5de505e041edf311730560d
SSDEEP

12288:5VGbImthaXa5j2asmTgnTlVY+KaBwPBlF3Z4mxxpDqVTVOCi:5gEmt7xgbwbQmXAVTzi

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1132	iexplore.ra

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\iexplore.ra	223813ceb88edbfde22d82ebb222db6c.exe
File opened for modification	C:\Windows\iexplore.ra	223813ceb88edbfde22d82ebb222db6c.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4608	223813ceb88edbfde22d82ebb222db6c.exe
Token: SeDebugPrivilege	1132	iexplore.ra

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1132	iexplore.ra

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 1120	1132	iexplore.ra	19
PID 1132 wrote to memory of 1120	1132	iexplore.ra	19

C:\Users\Admin\AppData\Local\Temp\223813ceb88edbfde22d82ebb222db6c.exe
"C:\Users\Admin\AppData\Local\Temp\223813ceb88edbfde22d82ebb222db6c.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4608

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
1⤵
PID:1120

C:\Windows\iexplore.ra
C:\Windows\iexplore.ra
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1132

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1132-65-0x0000000002040000-0x00000000020E2000-memory.dmp

Filesize
648KB

Download
memory/1132-67-0x0000000002040000-0x00000000020E2000-memory.dmp

Filesize
648KB

Download
memory/1132-66-0x0000000002040000-0x00000000020E2000-memory.dmp

Filesize
648KB

Download
memory/1132-64-0x0000000000E70000-0x0000000000EC4000-memory.dmp

Filesize
336KB

Download
memory/1132-63-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/4608-46-0x00000000034D0000-0x0000000003572000-memory.dmp

Filesize
648KB

Download
memory/4608-27-0x00000000034D0000-0x0000000003572000-memory.dmp

Filesize
648KB

Download
memory/4608-11-0x00000000034D0000-0x0000000003572000-memory.dmp

Filesize
648KB

Download
memory/4608-20-0x00000000034D0000-0x0000000003572000-memory.dmp

Filesize
648KB

Download
memory/4608-44-0x00000000034D0000-0x0000000003572000-memory.dmp

Filesize
648KB

Download
memory/4608-30-0x00000000034D0000-0x0000000003572000-memory.dmp

Filesize
648KB

Download
memory/4608-34-0x00000000034D0000-0x0000000003572000-memory.dmp

Filesize
648KB

Download
memory/4608-38-0x00000000034D0000-0x0000000003572000-memory.dmp

Filesize
648KB

Download
memory/4608-37-0x00000000034D0000-0x0000000003572000-memory.dmp

Filesize
648KB

Download
memory/4608-40-0x00000000034D0000-0x0000000003572000-memory.dmp

Filesize
648KB

Download
memory/4608-41-0x00000000034D0000-0x0000000003572000-memory.dmp

Filesize
648KB

Download
memory/4608-39-0x00000000034D0000-0x0000000003572000-memory.dmp

Filesize
648KB

Download
memory/4608-36-0x00000000034D0000-0x0000000003572000-memory.dmp

Filesize
648KB

Download
memory/4608-47-0x00000000034D0000-0x0000000003572000-memory.dmp

Filesize
648KB

Download
memory/4608-53-0x00000000034D0000-0x0000000003572000-memory.dmp

Filesize
648KB

Download
memory/4608-60-0x00000000035A0000-0x00000000035A1000-memory.dmp

Filesize
4KB

Download
memory/4608-59-0x00000000034D0000-0x0000000003572000-memory.dmp

Filesize
648KB

Download
memory/4608-58-0x0000000002590000-0x0000000002591000-memory.dmp

Filesize
4KB

Download
memory/4608-57-0x00000000024E0000-0x00000000024E1000-memory.dmp

Filesize
4KB

Download
memory/4608-56-0x00000000034D0000-0x0000000003572000-memory.dmp

Filesize
648KB

Download
memory/4608-55-0x00000000034D0000-0x0000000003572000-memory.dmp

Filesize
648KB

Download
memory/4608-54-0x00000000034D0000-0x0000000003572000-memory.dmp

Filesize
648KB

Download
memory/4608-52-0x00000000034D0000-0x0000000003572000-memory.dmp

Filesize
648KB

Download
memory/4608-51-0x00000000034D0000-0x0000000003572000-memory.dmp

Filesize
648KB

Download
memory/4608-50-0x00000000034D0000-0x0000000003572000-memory.dmp

Filesize
648KB

Download
memory/4608-49-0x00000000034D0000-0x0000000003572000-memory.dmp

Filesize
648KB

Download
memory/4608-48-0x00000000034D0000-0x0000000003572000-memory.dmp

Filesize
648KB

Download
memory/4608-0-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/4608-3-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download
memory/4608-1-0x00000000022E0000-0x0000000002334000-memory.dmp

Filesize
336KB

Download
memory/4608-43-0x00000000034D0000-0x0000000003572000-memory.dmp

Filesize
648KB

Download
memory/4608-42-0x00000000034D0000-0x0000000003572000-memory.dmp

Filesize
648KB

Download
memory/4608-35-0x00000000034D0000-0x0000000003572000-memory.dmp

Filesize
648KB

Download
memory/4608-33-0x00000000034D0000-0x0000000003572000-memory.dmp

Filesize
648KB

Download
memory/4608-32-0x00000000034D0000-0x0000000003572000-memory.dmp

Filesize
648KB

Download
memory/4608-31-0x00000000034D0000-0x0000000003572000-memory.dmp

Filesize
648KB

Download
memory/4608-29-0x00000000034D0000-0x0000000003572000-memory.dmp

Filesize
648KB

Download
memory/4608-28-0x00000000034D0000-0x0000000003572000-memory.dmp

Filesize
648KB

Download
memory/4608-24-0x00000000034D0000-0x0000000003572000-memory.dmp

Filesize
648KB

Download
memory/4608-23-0x00000000034D0000-0x0000000003572000-memory.dmp

Filesize
648KB

Download
memory/4608-22-0x00000000034D0000-0x0000000003572000-memory.dmp

Filesize
648KB

Download
memory/4608-21-0x00000000034D0000-0x0000000003572000-memory.dmp

Filesize
648KB

Download
memory/4608-19-0x00000000034D0000-0x0000000003572000-memory.dmp

Filesize
648KB

Download
memory/4608-18-0x00000000034D0000-0x0000000003572000-memory.dmp

Filesize
648KB

Download
memory/4608-17-0x00000000034D0000-0x0000000003572000-memory.dmp

Filesize
648KB

Download
memory/4608-16-0x00000000034D0000-0x0000000003572000-memory.dmp

Filesize
648KB

Download
memory/4608-15-0x00000000034D0000-0x0000000003572000-memory.dmp

Filesize
648KB

Download
memory/4608-14-0x00000000034D0000-0x0000000003572000-memory.dmp

Filesize
648KB

Download
memory/4608-13-0x00000000034D0000-0x0000000003572000-memory.dmp

Filesize
648KB

Download
memory/4608-12-0x00000000034D0000-0x0000000003572000-memory.dmp

Filesize
648KB

Download
memory/4608-9-0x0000000002580000-0x0000000002581000-memory.dmp

Filesize
4KB

Download
memory/4608-10-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download
memory/4608-7-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download
memory/4608-8-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download
memory/4608-6-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/4608-5-0x0000000002500000-0x0000000002501000-memory.dmp

Filesize
4KB

Download
memory/4608-4-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/4608-45-0x00000000034D0000-0x0000000003572000-memory.dmp

Filesize
648KB

Download
memory/4608-101-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/4608-2-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download