dbae0f7347617c31c0e20743e00d2281fb60143beec123ac9de525d46389c648

Analysis

max time kernel
1518s
max time network
1474s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20/02/2024, 20:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ul._15-ti_noemvri.jpg
Size

749KB
MD5

008a43d66a6a00e406a4235b72ac2246
SHA1

b93aa52491af2bd52cf0bf72af7e7d5c732a7dfe
SHA256

dbae0f7347617c31c0e20743e00d2281fb60143beec123ac9de525d46389c648
SHA512

c40e859f3c49cfacae78cadec26e2495e7945a0e9723ada29acafdb13c604b24b46c682560450443598ef3eaf8c52770ae4d845813e61b19e943daae087ed73e
SSDEEP

12288:PC1VfBro0fBzqyBA4Cwbu/qN0N2hNzWmMOcMmwMMXNzT/xSoGFB1U3u1TbhNE8on:PC1brv7O4u/ihpWfj2l8Eu1TbE8JDKue

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	4972	svchost.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ul._15-ti_noemvri.jpg
1⤵
PID:4080

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:728

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

Filesize
16KB

MD5
f82fd37c0835310f7faa7d1edba4367b

SHA1
b8afa515dad4f2118886fe2b9098e6949df13890

SHA256
92b119555a3bc59e0cd55bc7f8d84e13a1a3ed85f89d73e97936d2e06f9561ca

SHA512
02dbcc91eccf834813b84511b1d363851ad81ac30d04c8f095b6b8269fa331cc8c6358e79465e19e496bfb7d1fab25e81d832dfd574705a84506b88487c6b497

Download Submit
memory/4972-40-0x0000028929F00000-0x0000028929F01000-memory.dmp

Filesize
4KB

Download
memory/4972-42-0x0000028929F00000-0x0000028929F01000-memory.dmp

Filesize
4KB

Download
memory/4972-33-0x0000028929F00000-0x0000028929F01000-memory.dmp

Filesize
4KB

Download
memory/4972-34-0x0000028929F00000-0x0000028929F01000-memory.dmp

Filesize
4KB

Download
memory/4972-35-0x0000028929F00000-0x0000028929F01000-memory.dmp

Filesize
4KB

Download
memory/4972-36-0x0000028929F00000-0x0000028929F01000-memory.dmp

Filesize
4KB

Download
memory/4972-37-0x0000028929F00000-0x0000028929F01000-memory.dmp

Filesize
4KB

Download
memory/4972-38-0x0000028929F00000-0x0000028929F01000-memory.dmp

Filesize
4KB

Download
memory/4972-39-0x0000028929F00000-0x0000028929F01000-memory.dmp

Filesize
4KB

Download
memory/4972-43-0x0000028929B30000-0x0000028929B31000-memory.dmp

Filesize
4KB

Download
memory/4972-32-0x0000028929EE0000-0x0000028929EE1000-memory.dmp

Filesize
4KB

Download
memory/4972-41-0x0000028929F00000-0x0000028929F01000-memory.dmp

Filesize
4KB

Download
memory/4972-0-0x0000028921840000-0x0000028921850000-memory.dmp

Filesize
64KB

Download
memory/4972-44-0x0000028929B20000-0x0000028929B21000-memory.dmp

Filesize
4KB

Download
memory/4972-46-0x0000028929B30000-0x0000028929B31000-memory.dmp

Filesize
4KB

Download
memory/4972-49-0x0000028929B20000-0x0000028929B21000-memory.dmp

Filesize
4KB

Download
memory/4972-52-0x0000028929A60000-0x0000028929A61000-memory.dmp

Filesize
4KB

Download
memory/4972-16-0x0000028921940000-0x0000028921950000-memory.dmp

Filesize
64KB

Download
memory/4972-64-0x0000028929C60000-0x0000028929C61000-memory.dmp

Filesize
4KB

Download
memory/4972-66-0x0000028929C70000-0x0000028929C71000-memory.dmp

Filesize
4KB

Download
memory/4972-67-0x0000028929C70000-0x0000028929C71000-memory.dmp

Filesize
4KB

Download
memory/4972-68-0x0000028929D80000-0x0000028929D81000-memory.dmp

Filesize
4KB

Download