Analysis

  • max time kernel
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-01-2024 17:26

General

  • Target

    3d71102513741625e44562098fd655ee.exe

  • Size

    241KB

  • MD5

    3d71102513741625e44562098fd655ee

  • SHA1

    df9b61f87ef043515caafeee403443ba2eebdd60

  • SHA256

    5c20b43066d31ac310a4b41d2103c7e5f1e2c97301ac572d277acc12e17348af

  • SHA512

    5825f3e85b740ae3842b3e69f2f00f81f01e9737ad136eed4c89fcc1a4e378d3bcb93f8aad5536a73f1111270f5df2ce0b1853d34652dc924492550a315eb2a5

  • SSDEEP

    6144:CsY7cf92DU4H9nBn4hbbuVyUWYgH4Va5X3g4sVs:CSFufH1BnOPuPM4OX3gts

Score
6/10

Malware Config

Signatures

  • Modifies WinLogon 2 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3d71102513741625e44562098fd655ee.exe
    "C:\Users\Admin\AppData\Local\Temp\3d71102513741625e44562098fd655ee.exe"
    1⤵
    • Modifies WinLogon
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:464

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\9B71.tmp

    Filesize

    1KB

    MD5

    3861682f66133ab2c279b6235035b069

    SHA1

    ba05857f34ac27e23211c6da631598a2a4c90563

    SHA256

    d9f08a5230e505d1c29b5434507653ddf554cf0c4de3eed62d306f0241354028

    SHA512

    11bbeca4272f29c804d8397a5d3a50e7341e3512c401107cb2962c57422085c7954a4850d2300a45b436c7f4d35a88702bf27ea7fecbf102eb95508ae1fb92ab

  • C:\Users\Admin\AppData\Local\Temp\D0DC.tmp

    Filesize

    593B

    MD5

    926512864979bc27cf187f1de3f57aff

    SHA1

    acdeb9d6187932613c7fa08eaf28f0cd8116f4b5

    SHA256

    b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f

    SHA512

    f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b

  • C:\Users\Admin\AppData\Local\Temp\D9F9.tmp

    Filesize

    1KB

    MD5

    42fcb42052e29f3d29cd01cb6ada8dcb

    SHA1

    1b5a5714caf37693999b1856163fe410535c1b7e

    SHA256

    c61c848febd50af2284bbab567476b2cec68570413166efd1cf5203300f6a144

    SHA512

    75021980471b1f592f57d4a6dcda8a92d3e9d5ac0aa58b365a9d7a6a2d30e9fcac0890fc8e3c65df0f4898d886f2151256cae513ae461984d496d7b4ea4a97b3

  • memory/464-0-0x0000000000400000-0x00000000005F4000-memory.dmp

    Filesize

    2.0MB

  • memory/464-1-0x00000000023A0000-0x00000000023F8000-memory.dmp

    Filesize

    352KB

  • memory/464-2-0x0000000000400000-0x00000000005F4000-memory.dmp

    Filesize

    2.0MB

  • memory/464-4-0x00000000024C0000-0x0000000002574000-memory.dmp

    Filesize

    720KB

  • memory/464-5-0x0000000002A40000-0x0000000002B03000-memory.dmp

    Filesize

    780KB

  • memory/464-7-0x0000000002A40000-0x0000000002B03000-memory.dmp

    Filesize

    780KB

  • memory/464-11-0x0000000002A40000-0x0000000002B03000-memory.dmp

    Filesize

    780KB

  • memory/464-10-0x0000000002A40000-0x0000000002B03000-memory.dmp

    Filesize

    780KB

  • memory/464-116-0x0000000002A40000-0x0000000002B03000-memory.dmp

    Filesize

    780KB

  • memory/464-126-0x0000000002A40000-0x0000000002B03000-memory.dmp

    Filesize

    780KB

  • memory/464-130-0x0000000002A40000-0x0000000002B03000-memory.dmp

    Filesize

    780KB

  • memory/464-131-0x0000000002A40000-0x0000000002B03000-memory.dmp

    Filesize

    780KB

  • memory/464-138-0x0000000002A40000-0x0000000002B03000-memory.dmp

    Filesize

    780KB

  • memory/464-143-0x0000000002A40000-0x0000000002B03000-memory.dmp

    Filesize

    780KB

  • memory/464-145-0x0000000002A40000-0x0000000002B03000-memory.dmp

    Filesize

    780KB

  • memory/464-160-0x0000000002A40000-0x0000000002B03000-memory.dmp

    Filesize

    780KB

  • memory/464-162-0x0000000002A40000-0x0000000002B03000-memory.dmp

    Filesize

    780KB

  • memory/464-165-0x0000000002A40000-0x0000000002B03000-memory.dmp

    Filesize

    780KB

  • memory/464-163-0x0000000002A40000-0x0000000002B03000-memory.dmp

    Filesize

    780KB

  • memory/464-161-0x0000000002A40000-0x0000000002B03000-memory.dmp

    Filesize

    780KB

  • memory/464-159-0x0000000002A40000-0x0000000002B03000-memory.dmp

    Filesize

    780KB

  • memory/464-158-0x0000000002A40000-0x0000000002B03000-memory.dmp

    Filesize

    780KB

  • memory/464-157-0x0000000002A40000-0x0000000002B03000-memory.dmp

    Filesize

    780KB

  • memory/464-156-0x0000000002A40000-0x0000000002B03000-memory.dmp

    Filesize

    780KB

  • memory/464-155-0x0000000002A40000-0x0000000002B03000-memory.dmp

    Filesize

    780KB

  • memory/464-154-0x0000000002A40000-0x0000000002B03000-memory.dmp

    Filesize

    780KB

  • memory/464-153-0x0000000002A40000-0x0000000002B03000-memory.dmp

    Filesize

    780KB

  • memory/464-152-0x0000000002A40000-0x0000000002B03000-memory.dmp

    Filesize

    780KB

  • memory/464-142-0x0000000002A40000-0x0000000002B03000-memory.dmp

    Filesize

    780KB

  • memory/464-141-0x0000000002A40000-0x0000000002B03000-memory.dmp

    Filesize

    780KB

  • memory/464-140-0x0000000002A40000-0x0000000002B03000-memory.dmp

    Filesize

    780KB

  • memory/464-137-0x0000000002A40000-0x0000000002B03000-memory.dmp

    Filesize

    780KB

  • memory/464-136-0x0000000002A40000-0x0000000002B03000-memory.dmp

    Filesize

    780KB

  • memory/464-133-0x0000000002A40000-0x0000000002B03000-memory.dmp

    Filesize

    780KB

  • memory/464-128-0x0000000002A40000-0x0000000002B03000-memory.dmp

    Filesize

    780KB

  • memory/464-127-0x0000000002A40000-0x0000000002B03000-memory.dmp

    Filesize

    780KB

  • memory/464-125-0x0000000002A40000-0x0000000002B03000-memory.dmp

    Filesize

    780KB

  • memory/464-124-0x0000000002A40000-0x0000000002B03000-memory.dmp

    Filesize

    780KB

  • memory/464-123-0x0000000002A40000-0x0000000002B03000-memory.dmp

    Filesize

    780KB

  • memory/464-122-0x0000000002A40000-0x0000000002B03000-memory.dmp

    Filesize

    780KB

  • memory/464-121-0x0000000002A40000-0x0000000002B03000-memory.dmp

    Filesize

    780KB

  • memory/464-120-0x0000000002A40000-0x0000000002B03000-memory.dmp

    Filesize

    780KB

  • memory/464-119-0x0000000002A40000-0x0000000002B03000-memory.dmp

    Filesize

    780KB

  • memory/464-118-0x0000000002A40000-0x0000000002B03000-memory.dmp

    Filesize

    780KB

  • memory/464-117-0x0000000002A40000-0x0000000002B03000-memory.dmp

    Filesize

    780KB

  • memory/464-115-0x0000000002A40000-0x0000000002B03000-memory.dmp

    Filesize

    780KB

  • memory/464-114-0x0000000002A40000-0x0000000002B03000-memory.dmp

    Filesize

    780KB

  • memory/464-113-0x0000000002A40000-0x0000000002B03000-memory.dmp

    Filesize

    780KB

  • memory/464-295-0x00000000023A0000-0x00000000023F8000-memory.dmp

    Filesize

    352KB

  • memory/464-408-0x0000000000400000-0x00000000005F4000-memory.dmp

    Filesize

    2.0MB

  • memory/464-412-0x0000000002A40000-0x0000000002B03000-memory.dmp

    Filesize

    780KB