Analysis
-
max time kernel
142s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
08/01/2024, 04:15
Static task
static1
Behavioral task
behavioral1
Sample
4a69903d22bf91f398781b4c9ec374c2.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4a69903d22bf91f398781b4c9ec374c2.exe
Resource
win10v2004-20231215-en
General
-
Target
4a69903d22bf91f398781b4c9ec374c2.exe
-
Size
753KB
-
MD5
4a69903d22bf91f398781b4c9ec374c2
-
SHA1
165179e2a76184ded2bfcb398e3a31b73e3533ec
-
SHA256
61c588dbf3f007a23ddf6a686c20e44f452aa593f3ff9848be8be66801c6e227
-
SHA512
eddce9adc51512cb923367c0ef5b9dd397f1317f9dc1d9ba60716d8b8a348ec1833586f64c459a0de71ab57f311aabd8dce223819f6499f03f09ed9e5f7c464e
-
SSDEEP
12288:l5edwUnwkK53W2X60wrIo+yR7/gANtj5axxaFeKszs2GM+EkqNWGQb3s+wz:l5hwwkK5n6tMERTftj5axxaF/sI2aPku
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3244 dsffsd -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\dsffsd 4a69903d22bf91f398781b4c9ec374c2.exe File opened for modification C:\Windows\dsffsd 4a69903d22bf91f398781b4c9ec374c2.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4868 4a69903d22bf91f398781b4c9ec374c2.exe Token: SeDebugPrivilege 3244 dsffsd -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3244 dsffsd -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3244 wrote to memory of 824 3244 dsffsd 92 PID 3244 wrote to memory of 824 3244 dsffsd 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a69903d22bf91f398781b4c9ec374c2.exe"C:\Users\Admin\AppData\Local\Temp\4a69903d22bf91f398781b4c9ec374c2.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4868
-
C:\Windows\dsffsdC:\Windows\dsffsd1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Program Files\Internet Explorer\iExPlOrE.ExE"C:\Program Files\Internet Explorer\iExPlOrE.ExE"2⤵PID:824
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
753KB
MD54a69903d22bf91f398781b4c9ec374c2
SHA1165179e2a76184ded2bfcb398e3a31b73e3533ec
SHA25661c588dbf3f007a23ddf6a686c20e44f452aa593f3ff9848be8be66801c6e227
SHA512eddce9adc51512cb923367c0ef5b9dd397f1317f9dc1d9ba60716d8b8a348ec1833586f64c459a0de71ab57f311aabd8dce223819f6499f03f09ed9e5f7c464e