Resubmissions
21/02/2024, 22:28
240221-2d6lfagf691020/02/2024, 02:07
240220-cjy14shc8z1019/02/2024, 17:57
240219-wjrftaaa5s1001/02/2024, 17:44
240201-wbb16addcj10Analysis
- max time kernel
1520s - max time network
1484s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
19/02/2024, 17:57
General
- Target S500 CRASHED DESTROYED BY BIG DICK.zip
- Size 82.3MB
- Sample240219-wjrftaaa5s
- SHA256 511a99c70f3a3aaad381b3bf626e411b3b41f7a7cf3e040068a8cdddc6224296
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\S500 CRASHED DESTROYED BY BIG DICK.zip"1⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
store.jfm
memory/4436-40-0x0000025ED4F60000-0x0000025ED4F61000-memory.dmp
memory/4436-42-0x0000025ED4F60000-0x0000025ED4F61000-memory.dmp
memory/4436-33-0x0000025ED4F60000-0x0000025ED4F61000-memory.dmp
memory/4436-34-0x0000025ED4F60000-0x0000025ED4F61000-memory.dmp
memory/4436-35-0x0000025ED4F60000-0x0000025ED4F61000-memory.dmp
memory/4436-36-0x0000025ED4F60000-0x0000025ED4F61000-memory.dmp
memory/4436-37-0x0000025ED4F60000-0x0000025ED4F61000-memory.dmp
memory/4436-38-0x0000025ED4F60000-0x0000025ED4F61000-memory.dmp
memory/4436-39-0x0000025ED4F60000-0x0000025ED4F61000-memory.dmp
memory/4436-43-0x0000025ED4CA0000-0x0000025ED4CA1000-memory.dmp
memory/4436-32-0x0000025ED4F50000-0x0000025ED4F51000-memory.dmp
memory/4436-41-0x0000025ED4F60000-0x0000025ED4F61000-memory.dmp
memory/4436-0-0x0000025ECC960000-0x0000025ECC970000-memory.dmp
memory/4436-44-0x0000025ED4C90000-0x0000025ED4C91000-memory.dmp
memory/4436-46-0x0000025ED4CA0000-0x0000025ED4CA1000-memory.dmp
memory/4436-49-0x0000025ED4C90000-0x0000025ED4C91000-memory.dmp
memory/4436-52-0x0000025ED4BD0000-0x0000025ED4BD1000-memory.dmp
memory/4436-16-0x0000025ECCA60000-0x0000025ECCA70000-memory.dmp
memory/4436-64-0x0000025ED4DD0000-0x0000025ED4DD1000-memory.dmp
memory/4436-66-0x0000025ED4DE0000-0x0000025ED4DE1000-memory.dmp
memory/4436-67-0x0000025ED4DE0000-0x0000025ED4DE1000-memory.dmp
memory/4436-68-0x0000025ED4EF0000-0x0000025ED4EF1000-memory.dmp