Overview
overview
10Static
static
7samples3.zip
windows7-x64
1samples3.zip
windows10-2004-x64
105cf6eee9b...b3.exe
windows7-x64
105cf6eee9b...b3.exe
windows10-2004-x64
10d332c0478...a7.exe
windows7-x64
90d332c0478...a7.exe
windows10-2004-x64
90fd8500fde...1e.exe
windows7-x64
10fd8500fde...1e.exe
windows10-2004-x64
111edf9436a...ed.pdf
windows7-x64
111edf9436a...ed.pdf
windows10-2004-x64
119a640415b...5c.exe
windows7-x64
1019a640415b...5c.exe
windows10-2004-x64
1033aa57b04b...cb.exe
windows7-x64
633aa57b04b...cb.exe
windows10-2004-x64
63643464a22...19.exe
windows7-x64
33643464a22...19.exe
windows10-2004-x64
337e2f97755...26.exe
windows7-x64
137e2f97755...26.exe
windows10-2004-x64
154cd11236f...ff.exe
windows7-x64
654cd11236f...ff.exe
windows10-2004-x64
655bc661ad4...8c.exe
windows7-x64
955bc661ad4...8c.exe
windows10-2004-x64
7603d665f09...68.exe
windows7-x64
1603d665f09...68.exe
windows10-2004-x64
16ea27a0861...7e.exe
windows7-x64
16ea27a0861...7e.exe
windows10-2004-x64
373af283fcb...0c.exe
windows7-x64
873af283fcb...0c.exe
windows10-2004-x64
87e41197b74...67.exe
windows7-x64
97e41197b74...67.exe
windows10-2004-x64
9a878fed055...99.exe
windows7-x64
3a878fed055...99.exe
windows10-2004-x64
3Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
01-01-2024 15:27
Behavioral task
behavioral1
Sample
samples3.zip
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
samples3.zip
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
05cf6eee9b0b2c049cec8ce775de0636ade55f23a51dc833170f09445719abb3.exe
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
05cf6eee9b0b2c049cec8ce775de0636ade55f23a51dc833170f09445719abb3.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
0d332c04780976b3cf6d505b5d7060c2f40399f581a8629885ad086e967f68a7.exe
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
0d332c04780976b3cf6d505b5d7060c2f40399f581a8629885ad086e967f68a7.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
0fd8500fdef116abae01a1dcfed2db9784bbcb753488710aa1048f2aa0fd111e.exe
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
0fd8500fdef116abae01a1dcfed2db9784bbcb753488710aa1048f2aa0fd111e.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
11edf9436a9205c88c2a815cf6ebfb0a7a42eb150a2649766b3bb30350ee35ed.pdf
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
11edf9436a9205c88c2a815cf6ebfb0a7a42eb150a2649766b3bb30350ee35ed.pdf
Resource
win10v2004-20231222-en
Behavioral task
behavioral11
Sample
19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
3643464a225aa2ad5c9c9657d4fd05b943fdd9c04ca36b9d3610a04332909d19.exe
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
3643464a225aa2ad5c9c9657d4fd05b943fdd9c04ca36b9d3610a04332909d19.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
37e2f977559a58cb33f7128ad7699a5c4f7c0013d8d83b1eda93a59ae35ba526.exe
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
37e2f977559a58cb33f7128ad7699a5c4f7c0013d8d83b1eda93a59ae35ba526.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral19
Sample
54cd11236fdc2a40b505598541f64e8a6bd9ea84552b6d5946777badf8a2b7ff.exe
Resource
win7-20231215-en
Behavioral task
behavioral20
Sample
54cd11236fdc2a40b505598541f64e8a6bd9ea84552b6d5946777badf8a2b7ff.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
55bc661ad4439400fc434fd6bab66f598c7272854f0453b451e31b84265eff8c.exe
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
55bc661ad4439400fc434fd6bab66f598c7272854f0453b451e31b84265eff8c.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
603d665f09a9a199a4b5b9f8d1841a07ae9c525f275fc54c7cb15953d73ff568.exe
Resource
win7-20231129-en
Behavioral task
behavioral24
Sample
603d665f09a9a199a4b5b9f8d1841a07ae9c525f275fc54c7cb15953d73ff568.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral25
Sample
6ea27a08617ed35f8340fcc9eda5ccd7316eed9b192e3a7efd4cd5e1b8a4fc7e.exe
Resource
win7-20231129-en
Behavioral task
behavioral26
Sample
6ea27a08617ed35f8340fcc9eda5ccd7316eed9b192e3a7efd4cd5e1b8a4fc7e.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
73af283fcb06a9ea35ea6ad24b62b302459594f4b09dbba2d74001bf90ab020c.exe
Resource
win7-20231215-en
Behavioral task
behavioral28
Sample
73af283fcb06a9ea35ea6ad24b62b302459594f4b09dbba2d74001bf90ab020c.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral29
Sample
7e41197b74e2dcc6c0563d4b71a4ad16293909889ce4f1c5ab214bdd59088667.exe
Resource
win7-20231215-en
Behavioral task
behavioral30
Sample
7e41197b74e2dcc6c0563d4b71a4ad16293909889ce4f1c5ab214bdd59088667.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral31
Sample
a878fed05519b4e0898e26a79cc646c0bb7b9e380c94f06baecc750f0ab97b99.exe
Resource
win7-20231215-en
Behavioral task
behavioral32
Sample
a878fed05519b4e0898e26a79cc646c0bb7b9e380c94f06baecc750f0ab97b99.exe
Resource
win10v2004-20231222-en
General
-
Target
33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe
-
Size
46KB
-
MD5
8bcffc24d7a50cdff0c52c46a7a124fa
-
SHA1
f6e439f1503c727deb6d2a5d09b4a455728a0217
-
SHA256
33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb
-
SHA512
e87023b4f56852a9f8f340f8476dc2d91d1216845816fcf74fe561b625de18628b9f3e1fe21236b20066dd83838d6d6ea4338424a89b998c7e82edf6e829fb2c
-
SSDEEP
768:7HQRmGZ1BcDZzEdjRBeV6rgd7Ai4XqobtXg6aKlnRSc:7dGO6ddBesrgd0iuq2tXg6hlh
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Main = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe\"" 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exepid process 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exedescription pid process Token: SeDebugPrivilege 1364 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe"C:\Users\Admin\AppData\Local\Temp\33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1364
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1364-1-0x0000000074910000-0x00000000750C0000-memory.dmpFilesize
7.7MB
-
memory/1364-2-0x0000000005A50000-0x0000000005FF4000-memory.dmpFilesize
5.6MB
-
memory/1364-3-0x0000000005540000-0x00000000055D2000-memory.dmpFilesize
584KB
-
memory/1364-0-0x0000000000B20000-0x0000000000B32000-memory.dmpFilesize
72KB
-
memory/1364-5-0x00000000056E0000-0x00000000056EA000-memory.dmpFilesize
40KB
-
memory/1364-4-0x0000000005740000-0x0000000005750000-memory.dmpFilesize
64KB
-
memory/1364-6-0x0000000074910000-0x00000000750C0000-memory.dmpFilesize
7.7MB
-
memory/1364-7-0x0000000005740000-0x0000000005750000-memory.dmpFilesize
64KB
-
memory/1364-8-0x0000000005740000-0x0000000005750000-memory.dmpFilesize
64KB