bd2eef27f52ad9c22539daa83486281258cbe9c21d5c4ea44704044b3e01f50b

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/01/2024, 08:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

76ee14f5b0c80793b38db46dab243ff2.exe
Size

66KB
MD5

76ee14f5b0c80793b38db46dab243ff2
SHA1

867f7332006d6d673c72da3df9e24d2f1ece22a4
SHA256

bd2eef27f52ad9c22539daa83486281258cbe9c21d5c4ea44704044b3e01f50b
SHA512

ed6a14dc9e8a5d21a78414c7e634f21cc7b832d6ed681202ccc99e7c571d600acfd1335e58ae58f76c6d26496ab34eee31c954d8380fef202a7a809cc7c245de
SSDEEP

1536:FMARI2x4BGUjGhfpOXhFoCS33tVEJct9+KxAxo:FV74Bt4pOxFHS33tVEJctQKxAxo

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\œ™…›Œ¤”’‘‘šG˜ŒŠ‰ˆÇ—µ™˜—Œ•”‡’›™Ž˜Œ‹”“ˆ‡š„ƒœ›š˜—–•Š›‘šI¬•§OŒT¬B”Þ^+,åþô©øù ìöøõ±óúºí	76ee14f5b0c80793b38db46dab243ff2.exe
File created	C:\Windows\SysWOW64\œ™…›Œ¤”’‘‘šG˜ŒŠ‰ˆÇ—µ™˜—Œ•”‡’›™Ž˜Œ‹”“ˆ‡š„ƒœ›š˜—–•Š›‘šI¬•§OŒT¬B”Þ^+,åþô©øù ìöøõ±óúºí	76ee14f5b0c80793b38db46dab243ff2.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	76ee14f5b0c80793b38db46dab243ff2.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	76ee14f5b0c80793b38db46dab243ff2.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2108	76ee14f5b0c80793b38db46dab243ff2.exe
Token: SeSecurityPrivilege	2108	76ee14f5b0c80793b38db46dab243ff2.exe
Token: SeTakeOwnershipPrivilege	2108	76ee14f5b0c80793b38db46dab243ff2.exe
Token: SeLoadDriverPrivilege	2108	76ee14f5b0c80793b38db46dab243ff2.exe
Token: SeSystemProfilePrivilege	2108	76ee14f5b0c80793b38db46dab243ff2.exe
Token: SeSystemtimePrivilege	2108	76ee14f5b0c80793b38db46dab243ff2.exe
Token: SeProfSingleProcessPrivilege	2108	76ee14f5b0c80793b38db46dab243ff2.exe
Token: SeIncBasePriorityPrivilege	2108	76ee14f5b0c80793b38db46dab243ff2.exe
Token: SeCreatePagefilePrivilege	2108	76ee14f5b0c80793b38db46dab243ff2.exe
Token: SeBackupPrivilege	2108	76ee14f5b0c80793b38db46dab243ff2.exe
Token: SeRestorePrivilege	2108	76ee14f5b0c80793b38db46dab243ff2.exe
Token: SeShutdownPrivilege	2108	76ee14f5b0c80793b38db46dab243ff2.exe
Token: SeDebugPrivilege	2108	76ee14f5b0c80793b38db46dab243ff2.exe
Token: SeSystemEnvironmentPrivilege	2108	76ee14f5b0c80793b38db46dab243ff2.exe
Token: SeRemoteShutdownPrivilege	2108	76ee14f5b0c80793b38db46dab243ff2.exe
Token: SeUndockPrivilege	2108	76ee14f5b0c80793b38db46dab243ff2.exe
Token: SeManageVolumePrivilege	2108	76ee14f5b0c80793b38db46dab243ff2.exe
Token: 33	2108	76ee14f5b0c80793b38db46dab243ff2.exe
Token: 34	2108	76ee14f5b0c80793b38db46dab243ff2.exe
Token: 35	2108	76ee14f5b0c80793b38db46dab243ff2.exe

C:\Users\Admin\AppData\Local\Temp\76ee14f5b0c80793b38db46dab243ff2.exe
"C:\Users\Admin\AppData\Local\Temp\76ee14f5b0c80793b38db46dab243ff2.exe"
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2108-0-0x0000000000400000-0x0000000000419600-memory.dmp

Filesize
101KB

Download