16ecbb4c7d777c9174de85af9dd6f672ad484cb0bfd4da3018ac768fdd120172 | Triage

Analysis

max time kernel
0s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 04:12

Sharing

Report Analysis Logs

General

Target

27a69ab14b60a27cb207624505f07ab5.exe
Size

27KB
MD5

27a69ab14b60a27cb207624505f07ab5
SHA1

a0301e76029138d5971fac10dd121098e16c5bc8
SHA256

16ecbb4c7d777c9174de85af9dd6f672ad484cb0bfd4da3018ac768fdd120172
SHA512

d79a32eaf8b16d0c106b0145a7b0bbda00389ed33292300e43c509a5f1fa44cf785cebfd8847c9f12257d4398f3d72637998b30f23ef53253aa6e0bcf6eff58b
SSDEEP

384:hvrwnbNjmFdh9cYwy8SWyEtrjcL3iE7p4KV68a6F/:9EnbNyq0XWNC7p4m68ak

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\genericusbfn.inf_amd64_53931f0ae21d6d2c\genericusbfn.sys	27a69ab14b60a27cb207624505f07ab5.exe
File created	C:\Windows\System32\DriverStore\FileRepository\compositebus.inf_amd64_7500cffa210c6946\CompositeBus.sys	27a69ab14b60a27cb207624505f07ab5.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4920	27a69ab14b60a27cb207624505f07ab5.exe

C:\Users\Admin\AppData\Local\Temp\27a69ab14b60a27cb207624505f07ab5.exe
"C:\Users\Admin\AppData\Local\Temp\27a69ab14b60a27cb207624505f07ab5.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4920
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" %1
  2⤵
  PID:224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4920-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4920-1-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4920-45-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download