Analysis

  • max time kernel
    142s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/01/2024, 05:19

General

  • Target

    795f466f1d7046801dff29d26e922b35.exe

  • Size

    906KB

  • MD5

    795f466f1d7046801dff29d26e922b35

  • SHA1

    95d942b20ec16b4311e35cfb12a94293cad69851

  • SHA256

    81c5ece1954156740f639f838730f9f27f2dbb17b7752f525a715d4bc0fa03e8

  • SHA512

    81aab8bb72c1c379d40dd50572c748b296a83dde127ecae441140ba0fe40da9609ad629e5d3a67cae1069183ee3db3e3cbb8fcbd72ef7d24528a758121ee21ca

  • SSDEEP

    24576:ahkYErrvfgKDMq4SiagonfDb451LHCKjZOlNr45cIzCAxOj9mNL6rGB4:1YarIOMq4ShffDUPLi3P4D

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\795f466f1d7046801dff29d26e922b35.exe
    "C:\Users\Admin\AppData\Local\Temp\795f466f1d7046801dff29d26e922b35.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2724
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
      dw20.exe -x -s 1076
      2⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:4716

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2724-0-0x0000000075180000-0x0000000075731000-memory.dmp

    Filesize

    5.7MB

  • memory/2724-1-0x0000000075180000-0x0000000075731000-memory.dmp

    Filesize

    5.7MB

  • memory/2724-2-0x0000000000DF0000-0x0000000000E00000-memory.dmp

    Filesize

    64KB

  • memory/2724-9-0x0000000075180000-0x0000000075731000-memory.dmp

    Filesize

    5.7MB