Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
12/01/2024, 19:40
General
-
Target
5755efd4e347c9c30e898023adcb2ffe.exe
-
Size
419KB
-
MD5
5755efd4e347c9c30e898023adcb2ffe
-
SHA1
bb8792eef67cb4ee9c5d523e1bcaaea8fdbce2c5
-
SHA256
66349384c0eec6d6522913323e631b734d95f4b1d9a7bf858b40ad7d0a0dd99e
-
SHA512
4b3bba46b17248a4575e756cd7dadac9f0e6479547572699bfff880b504ca92e16775254073420df7d19c2bbaca657fe408aab61638f74d14559d99c2b310f86
-
SSDEEP
12288:0Z3/DYraQS9xo+BDL1qy54taMLKYzZx4V:6LYraQS9y+FL1bOtaMLjzZx
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
Modifies data under HKEY_USERS 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5755efd4e347c9c30e898023adcb2ffe.exe"C:\Users\Admin\AppData\Local\Temp\5755efd4e347c9c30e898023adcb2ffe.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system.cnC:\Windows\system.cn1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
419KB
MD55755efd4e347c9c30e898023adcb2ffe
SHA1bb8792eef67cb4ee9c5d523e1bcaaea8fdbce2c5
SHA25666349384c0eec6d6522913323e631b734d95f4b1d9a7bf858b40ad7d0a0dd99e
SHA5124b3bba46b17248a4575e756cd7dadac9f0e6479547572699bfff880b504ca92e16775254073420df7d19c2bbaca657fe408aab61638f74d14559d99c2b310f86
-
Filesize
944KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
944KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
944KB
-
Filesize
8KB
-
Filesize
4KB