Resubmissions
19/02/2024, 04:29
240219-e399lahh25319/02/2024, 04:26
240219-e2m3nshg96519/02/2024, 04:23
240219-ezwl2ahe6z5Analysis
- max time kernel
1718s - max time network
1167s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
19/02/2024, 04:29
General
- Target Imagen de WhatsApp 2024-02-18 a las 14.48.17_ae90a7eb.jpg
- Size 137KB
- Sample240219-e399lahh25
- SHA256 f5d596e7487648ec9a72fc0070928a4bcb4cece4274f42009e8001580ff3b5ab
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Imagen de WhatsApp 2024-02-18 a las 14.48.17_ae90a7eb.jpg"1⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/560-0-0x000001DABB040000-0x000001DABB050000-memory.dmp
memory/560-16-0x000001DABB140000-0x000001DABB150000-memory.dmp
memory/560-32-0x000001DAC36F0000-0x000001DAC36F1000-memory.dmp
memory/560-33-0x000001DAC3710000-0x000001DAC3711000-memory.dmp
memory/560-34-0x000001DAC3710000-0x000001DAC3711000-memory.dmp
memory/560-35-0x000001DAC3710000-0x000001DAC3711000-memory.dmp
memory/560-36-0x000001DAC3710000-0x000001DAC3711000-memory.dmp
memory/560-37-0x000001DAC3710000-0x000001DAC3711000-memory.dmp
memory/560-38-0x000001DAC3710000-0x000001DAC3711000-memory.dmp
memory/560-39-0x000001DAC3710000-0x000001DAC3711000-memory.dmp
memory/560-40-0x000001DAC3710000-0x000001DAC3711000-memory.dmp
memory/560-41-0x000001DAC3710000-0x000001DAC3711000-memory.dmp
memory/560-42-0x000001DAC3710000-0x000001DAC3711000-memory.dmp
memory/560-43-0x000001DAC3340000-0x000001DAC3341000-memory.dmp
memory/560-44-0x000001DAC3330000-0x000001DAC3331000-memory.dmp
memory/560-46-0x000001DAC3340000-0x000001DAC3341000-memory.dmp
memory/560-49-0x000001DAC3330000-0x000001DAC3331000-memory.dmp
memory/560-52-0x000001DAC3270000-0x000001DAC3271000-memory.dmp
memory/560-64-0x000001DAC3470000-0x000001DAC3471000-memory.dmp
memory/560-66-0x000001DAC3480000-0x000001DAC3481000-memory.dmp
memory/560-67-0x000001DAC3480000-0x000001DAC3481000-memory.dmp
memory/560-68-0x000001DAC3590000-0x000001DAC3591000-memory.dmp