09d8a3969d7d7ea093564f8f2aa3c0a8083c07174ed838b7f57fb26e20c6a8ac

Analysis

max time kernel
174s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 04:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2787da5b067f7ea95a371759cd197f32.exe
Size

104KB
MD5

2787da5b067f7ea95a371759cd197f32
SHA1

3c6bc6b49aa34afbae62fd4e3c6d9e17dcc39b31
SHA256

09d8a3969d7d7ea093564f8f2aa3c0a8083c07174ed838b7f57fb26e20c6a8ac
SHA512

30c832a551cd669ee1baf91e52508c95fe9b76abe81ac9c3fd0d0f1cbc670f3a592de7080e9b2aea52a0efbf4e19a0d284a702443be61039896cefb90cb48d27
SSDEEP

1536:+/W0NjhAcBkD3RNE0fRQCM/rckfOc+ZtfCiq+g75izPSXPxd:+/W0NjNkD3nE+dYOBZVCiq9IzP4Pv

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\GroupPolicy\Machine\Scripts\fuck.txt	2787da5b067f7ea95a371759cd197f32.exe
File created	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	2787da5b067f7ea95a371759cd197f32.exe
File opened for modification	C:\Windows\SysWOW64\info.dat	2787da5b067f7ea95a371759cd197f32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings	2787da5b067f7ea95a371759cd197f32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1612	2787da5b067f7ea95a371759cd197f32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1612	2787da5b067f7ea95a371759cd197f32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1612	2787da5b067f7ea95a371759cd197f32.exe
Token: 16313249598049091584	1612	2787da5b067f7ea95a371759cd197f32.exe

C:\Users\Admin\AppData\Local\Temp\2787da5b067f7ea95a371759cd197f32.exe
"C:\Users\Admin\AppData\Local\Temp\2787da5b067f7ea95a371759cd197f32.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:1612

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...