Analysis
-
max time kernel
183s -
max time network
274s -
platform
windows11-21h2_x64 -
resource
win11-20240214-en -
resource tags
-
submitted
17/02/2024, 05:42
General
-
Target
internal.exe
-
Size
517KB
-
MD5
534eb183bdb5d1789191589b42c54ed4
-
SHA1
ec9018b0c65a2ac603f33c99367951fbec3fe309
-
SHA256
800c36850225857241f28b22e7ad91783b58e1622c8bb86245e29f8d5095a27c
-
SHA512
ebec7fd02cc83d184b9908118ee4a43174e34d9f5d9906b4e365c858986ec51b47c9497329561c26bd1c802646741abb7dd21b6c5bcccc3743244815c68a70f7
-
SSDEEP
6144:x1VVgoJF+nF7d8cbecDu5n6X96fz9xiJ4qBRtbvWjoAqDZ0b3JxOoBN6gKTBNOjp:xodpu5n07RtbDZ0b3Jx3DCQ
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Control Panel 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\internal.exe"C:\Users\Admin\AppData\Local\Temp\internal.exe"1⤵
- Drops file in System32 directory
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
536KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
224KB
-
Filesize
56KB
-
Filesize
72KB
-
Filesize
40KB
-
Filesize
152KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB