Analysis
- max time kernel
132s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
19/01/2024, 14:41
General
- Target ForceCPU.exe
- Size 19KB
- Sample240119-r2eshsged3
- SHA256 2d209c2b823e350c1f1661f87a3a013804302477afe56877f94adbafe7a2e06d
Score
1/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ForceCPU.exe"C:\Users\Admin\AppData\Local\Temp\ForceCPU.exe"1⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1532-0-0x00000000007D0000-0x00000000007D8000-memory.dmp
memory/1532-2-0x00007FFAE5590000-0x00007FFAE6051000-memory.dmp
memory/1532-3-0x00007FFAE5590000-0x00007FFAE6051000-memory.dmp
memory/2272-20-0x0000017415250000-0x0000017415260000-memory.dmp
memory/2272-4-0x0000017415150000-0x0000017415160000-memory.dmp
memory/2272-36-0x000001741D5C0000-0x000001741D5C1000-memory.dmp
memory/2272-38-0x000001741D5F0000-0x000001741D5F1000-memory.dmp
memory/2272-39-0x000001741D5F0000-0x000001741D5F1000-memory.dmp
memory/2272-40-0x000001741D700000-0x000001741D701000-memory.dmp