Analysis
-
max time kernel
151s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
06-01-2024 11:55
General
-
Target
462aa2ad1b98a1d305048280f6156807.exe
-
Size
59KB
-
MD5
462aa2ad1b98a1d305048280f6156807
-
SHA1
4881a06b45ebd60f86ca4520e68343b1b0ec1d54
-
SHA256
ad9c8fd5b86108c464ac4c69cdeefedd3f06cde18819d9f2f3c887737612708a
-
SHA512
86c402a2b02772180b56d47e9e7d141d2bd070a6042fd0a8955856a4dbc459076c839bbfa12fe76f082f1bccce4b839d999db244c7ff80c8a464ca3c0076f787
-
SSDEEP
1536:+ZMdjHXJqEeqZFlKuhpaaZV8oayGsUHEUXtU7E:H55qOZFAuhl6JpHg7E
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\462aa2ad1b98a1d305048280f6156807.exe"C:\Users\Admin\AppData\Local\Temp\462aa2ad1b98a1d305048280f6156807.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\CbEvtSvc.exeC:\Windows\SysWOW64\CbEvtSvc.exe -k netsvcs1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59KB
MD5462aa2ad1b98a1d305048280f6156807
SHA14881a06b45ebd60f86ca4520e68343b1b0ec1d54
SHA256ad9c8fd5b86108c464ac4c69cdeefedd3f06cde18819d9f2f3c887737612708a
SHA51286c402a2b02772180b56d47e9e7d141d2bd070a6042fd0a8955856a4dbc459076c839bbfa12fe76f082f1bccce4b839d999db244c7ff80c8a464ca3c0076f787
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB