Analysis
-
max time kernel
299s -
max time network
294s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12/01/2024, 08:57
Static task
static1
Behavioral task
behavioral1
Sample
test_large.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
test_large.exe
Resource
win10v2004-20231215-en
General
-
Target
test_large.exe
-
Size
3.3MB
-
MD5
f6bb217ef41610cae7da63e70f35c7ed
-
SHA1
fa001c38d8a526dc08c6a4a6fed53d1d2e3fccc0
-
SHA256
7e9db9bf79d4bafa9ae16ba6d2d7ef4f065be9b40eee62b4f03084961e8457ad
-
SHA512
3f584ee154967d86079345ea1451ab99afdd0202b406dd31d0d1ae3cfdeeda233e8181cc85c0ceb718defd033480b3ebe9faf691a4c75a56d6eefb73ef484bbf
-
SSDEEP
49152:iV1NybKv+m+4FA5utGHrQwthfpaHh/Kw+FwKQ:iuKvG4b
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeManageVolumePrivilege 3196 svchost.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3008 test_large.exe 3008 test_large.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\test_large.exe"C:\Users\Admin\AppData\Local\Temp\test_large.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:3008
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵PID:3644
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3196
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD5bbf48ce1c7e357bf17814e12fb360a30
SHA16849249eb8b8d769269419015e33098db1c8fd54
SHA2565d72ac4f08a17a0962496d1008e1606d8cbe1cfbddbf740179d9be68bba6373c
SHA5129640d211fa2ce73efab85636d717b6530a6b300d68208066bf284825448ae8ab7b8daaeebe9bab61228f56006f0b0d87e0cb0976c20d1f4a1211ae76f7dddfc7