Analysis
-
max time kernel
146s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
16-01-2024 10:30
General
-
Target
5fabc724f1191428b447c86a23aa3092.dll
-
Size
299KB
-
MD5
5fabc724f1191428b447c86a23aa3092
-
SHA1
3857722c33cc2140225ac74884175f850c6ec295
-
SHA256
27cc74d89f7c06b84a52e0d77251d7343dc2f4708c16ae4ffcef4e41ec656dfa
-
SHA512
e4448d881bbd7112f899cc38ee7ef625b26f5ca349c9956b7f33c81a51a15f8aa917cdfd4704b7ec072acde7d4ef924897b993b7a022bdcba2fcdf34e0b6894c
-
SSDEEP
6144:rTW3YgVzMS73tzrVmSavGXQ+90sGjGms4+/NoNZra8dOJCUJ8eANlq:rTW3YmzMc3tzrVmLvGA5sGimst/NQ/Uv
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5fabc724f1191428b447c86a23aa3092.dll,#11⤵
- Drops file in System32 directory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\rundll32.exeC:\Windows\system32\rundll32.exe -u1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB