Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
09/01/2024, 01:00
General
-
Target
0f11aeecbde1f355d26c9d406dad80cb0ae8536aea31fdddaf915d4afd434f3f.exe
-
Size
3.0MB
-
MD5
0a4f321c903a7fbc59566918c12aca09
-
SHA1
b4b918a5898463dad1c7d823e0b3f828bac15aad
-
SHA256
0f11aeecbde1f355d26c9d406dad80cb0ae8536aea31fdddaf915d4afd434f3f
-
SHA512
66441969351c684fd16db5c646f09a8b09235a9cb7d2a74f9562b91410f9df17db88722c92efc8e02a61b2c65cb01ca4692f356695176041bf2c885b51da202b
-
SSDEEP
12288:2IQT0O8iS1vavPvK9qerzrnz2vu9gqr2A30bOjybJzItviNQ:FQT0O80vPi9h3rz19gqr2A3UOOJzI11
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f11aeecbde1f355d26c9d406dad80cb0ae8536aea31fdddaf915d4afd434f3f.exe"C:\Users\Admin\AppData\Local\Temp\0f11aeecbde1f355d26c9d406dad80cb0ae8536aea31fdddaf915d4afd434f3f.exe"1⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken