Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
01/01/2024, 19:58
General
-
Target
0fdcc0cb76709415a3d012a793b7c242.exe
-
Size
204KB
-
MD5
0fdcc0cb76709415a3d012a793b7c242
-
SHA1
6f9bcf220402c6975764afe13564e1f81e743413
-
SHA256
d3de3e6c2dc952fdd18f05cdc0364258755028ac17e8873091e52bc50a576d9e
-
SHA512
d4b34576888dc02d056e5f85ce18ee08a8b0c61d7da86d62693d580d3abc86e2c3d3cb2541668ad2be4bb94f35db32f6a48daee7edcd39393c826a04d4cddc88
-
SSDEEP
3072:4qVYtrjsN9NhlcOAeT4WWDQ8KKwirAKVd8RqttfH3x:lKtnsN9Nvc6DWECwyXX8RqP3x
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Windows directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0fdcc0cb76709415a3d012a793b7c242.exe"C:\Users\Admin\AppData\Local\Temp\0fdcc0cb76709415a3d012a793b7c242.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken