Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    24-01-2024 13:35

General

  • Target

    7245e939ef77b51bfb149cacf46420735c7e128aebda59753c0ff9e000a751f9.exe

  • Size

    1.4MB

  • MD5

    b77d45ebe61fb1fda1dc9fd6d9c72244

  • SHA1

    c821c4c07a95715952a241e0d46f535a4d8e0c63

  • SHA256

    7245e939ef77b51bfb149cacf46420735c7e128aebda59753c0ff9e000a751f9

  • SHA512

    80af53db3ef00c0634de96e7eee518a6ddc1cee8f4fc3f8c0eb3cda01e92a4e204e611bcb65df0dae995eee710b698cf0612e09b4c32edf0ebcb7b2c5328d2c6

  • SSDEEP

    24576:4A9BE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4gELNiXicJFFRGNzj3

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7245e939ef77b51bfb149cacf46420735c7e128aebda59753c0ff9e000a751f9.exe
    "C:\Users\Admin\AppData\Local\Temp\7245e939ef77b51bfb149cacf46420735c7e128aebda59753c0ff9e000a751f9.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2884-0-0x0000000000400000-0x000000000060C000-memory.dmp

    Filesize

    2.0MB

  • memory/2884-1-0x00000000002D0000-0x0000000000336000-memory.dmp

    Filesize

    408KB

  • memory/2884-6-0x00000000002D0000-0x0000000000336000-memory.dmp

    Filesize

    408KB

  • memory/2884-7-0x00000000002D0000-0x0000000000336000-memory.dmp

    Filesize

    408KB

  • memory/2884-11-0x0000000000400000-0x000000000060C000-memory.dmp

    Filesize

    2.0MB