Analysis

  • max time kernel
    92s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/02/2024, 04:55

General

  • Target

    85fbefd4a870aff7badb47fcbee5f00c.exe

  • Size

    117KB

  • MD5

    85fbefd4a870aff7badb47fcbee5f00c

  • SHA1

    d51356c00226fd41b79c77eb65ee088e13086421

  • SHA256

    0b5cf849c6f60101f270155ad6408877ef07f1a461653bbc9ca01349815553c5

  • SHA512

    99060d05681824592d551c254ab8dbd8192204864db3e71655cf89bbd456f4d112c582c882f1f53959ee3eed0db942f4e58cb01ccdb53a942f909ca4a654f0c1

  • SSDEEP

    1536:49Vxv42+A2qgJM8/G+nezRgouYXWIB3+Tx648O/IP:gpeO0QzuYXfB3ixM6IP

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\85fbefd4a870aff7badb47fcbee5f00c.exe
    "C:\Users\Admin\AppData\Local\Temp\85fbefd4a870aff7badb47fcbee5f00c.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:404

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/404-0-0x0000000000E50000-0x0000000000E76000-memory.dmp

    Filesize

    152KB

  • memory/404-1-0x0000000001610000-0x000000000162E000-memory.dmp

    Filesize

    120KB

  • memory/404-2-0x00007FF977A80000-0x00007FF978541000-memory.dmp

    Filesize

    10.8MB

  • memory/404-3-0x000000001BAF0000-0x000000001BB00000-memory.dmp

    Filesize

    64KB

  • memory/404-5-0x00007FF977A80000-0x00007FF978541000-memory.dmp

    Filesize

    10.8MB