Analysis

  • max time kernel
    140s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-01-2024 09:17

General

  • Target

    7f76aa85e20777f406a8d65a10ed4875.exe

  • Size

    312KB

  • MD5

    7f76aa85e20777f406a8d65a10ed4875

  • SHA1

    b56ee2cd93cfd5c393f618b22c32de0942e66c16

  • SHA256

    241014afd1932118e3253f5c74501aec6f573a379199a038ed1043296730713f

  • SHA512

    8919bbcc158e45f9d54772ce903d100069e2a2870070574f0542c5c67a7d5640b6e154d9227fec41e9e2704510a2ac6caadd5ba52e3a9833b96d0523995422c9

  • SSDEEP

    3072:qwbqks+CRoRHf/00jN/wfLERR8zsH1j0JsYUncjIdqIdpYGLcgcO9U004NOFVqDo:qweks+CRv0mfLQ8zW1Osdnp1t993cYgn

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7f76aa85e20777f406a8d65a10ed4875.exe
    "C:\Users\Admin\AppData\Local\Temp\7f76aa85e20777f406a8d65a10ed4875.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\bhsA587.tmp

    Filesize

    242KB

    MD5

    2d624279cf930ac204f8d9c9c5370d53

    SHA1

    94ced8f710684026c4d6276b5233ea03d54a1d93

    SHA256

    8f6306f6fdca3387a7a4f825122fee6a07b37b1eb3c15242d51c2930e31bb81d

    SHA512

    f35801b1149d4b4ffdb21056b26b06ba116c3402b0e863c4acf0cfe57e20079a1aaaa1f064998d8fd27d6194382d7a1888c8df804441d68d8d231723f7500e57

  • memory/2944-7-0x0000000005430000-0x000000000543A000-memory.dmp

    Filesize

    40KB

  • memory/2944-3-0x00000000014A0000-0x00000000014E2000-memory.dmp

    Filesize

    264KB

  • memory/2944-4-0x0000000005450000-0x0000000005460000-memory.dmp

    Filesize

    64KB

  • memory/2944-5-0x0000000005B00000-0x00000000060A4000-memory.dmp

    Filesize

    5.6MB

  • memory/2944-6-0x0000000005550000-0x00000000055E2000-memory.dmp

    Filesize

    584KB

  • memory/2944-0-0x0000000074740000-0x0000000074EF0000-memory.dmp

    Filesize

    7.7MB

  • memory/2944-8-0x0000000005450000-0x0000000005460000-memory.dmp

    Filesize

    64KB

  • memory/2944-9-0x0000000005450000-0x0000000005460000-memory.dmp

    Filesize

    64KB

  • memory/2944-10-0x0000000008D80000-0x0000000008DE6000-memory.dmp

    Filesize

    408KB

  • memory/2944-19-0x000000000B2F0000-0x000000000BA96000-memory.dmp

    Filesize

    7.6MB

  • memory/2944-20-0x0000000074740000-0x0000000074EF0000-memory.dmp

    Filesize

    7.7MB

  • memory/2944-21-0x0000000005450000-0x0000000005460000-memory.dmp

    Filesize

    64KB

  • memory/2944-22-0x0000000005450000-0x0000000005460000-memory.dmp

    Filesize

    64KB

  • memory/2944-23-0x0000000005450000-0x0000000005460000-memory.dmp

    Filesize

    64KB