882f604f3a82daa9ead145643a06f2373ef7b614a152fdc9a0cc948bf8c78be8

Analysis

max time kernel
19s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 14:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39b175ef0f13dc0421aeae464984d297.exe
Size

252KB
MD5

39b175ef0f13dc0421aeae464984d297
SHA1

3c66951eef698efde86defa63dd6db564fdc994f
SHA256

882f604f3a82daa9ead145643a06f2373ef7b614a152fdc9a0cc948bf8c78be8
SHA512

ecf481212b639ed4f433f90a39fb017e062f30814e8d389f1d073bbacb0ad8df958502847cc84769f2cc4729e936faf67d24964efe6af7cdea4a2478a623a8ea
SSDEEP

3072:T5uNO+8s6V5WQZV08YLmqa/Qh10UNtGOWmI3hLKKKKKU8AAFTbp8ELQHsoOJNuYG:T5W8sscuVVYLOoh1MyfJXnIZRBv

Score

1^/10

Malware Config

Signatures

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	5024	dwm.exe
Token: SeChangeNotifyPrivilege	5024	dwm.exe
Token: 33	5024	dwm.exe
Token: SeIncBasePriorityPrivilege	5024	dwm.exe

C:\Users\Admin\AppData\Local\Temp\39b175ef0f13dc0421aeae464984d297.exe
"C:\Users\Admin\AppData\Local\Temp\39b175ef0f13dc0421aeae464984d297.exe"
1⤵
PID:3008

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5024

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:4748

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1508

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads