Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
15-01-2024 04:31
General
-
Target
3bb50696fc2f55a72ec8863a5d3933d03057aed8acf2bde5f8ccd000dac0a480.exe
-
Size
1.3MB
-
MD5
7f1f9bf38d4788eff998fe8c6807cc77
-
SHA1
791c5653e7d198f009e8f8d49e487895e32857f9
-
SHA256
3bb50696fc2f55a72ec8863a5d3933d03057aed8acf2bde5f8ccd000dac0a480
-
SHA512
34ba5eba0a2e94ff674c2568399010819e1a698989ce75e742e557f218729da0d4a6e0ef6df3bac54042a3fe77826ae4c57f138f3647c03c8f39f93726b8932f
-
SSDEEP
24576:R/CKABcaHsK+fM2jEaNZBqoeW7V6tGLfHtqls+0:RaKkcksDM2jh3BqS7YtGL/Als
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3bb50696fc2f55a72ec8863a5d3933d03057aed8acf2bde5f8ccd000dac0a480.exe"C:\Users\Admin\AppData\Local\Temp\3bb50696fc2f55a72ec8863a5d3933d03057aed8acf2bde5f8ccd000dac0a480.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD50f859d0912109ac77cf5ce6469c724f1
SHA199c033e56f6d0c6f0149c4a1fce1076fc2b8612d
SHA2568540748ec4a04042784a7c65f6c42bddb2539fa2d4ca1263bf331ed2e5e6975a
SHA512fc7e720062230a19d79f0fcf2fbbb61e14c98ad36564ca72130ad513ac9e219dc0899744ff63075dccbe354a8d8d0062d96125fc2ce34375f7e8c1d2b1c0a155
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
412KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB