Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
24-02-2024 22:13
General
-
Target
ID to Token.py
-
Size
1KB
-
MD5
5d8db8ae8f10b35cf1298f31fdf05d12
-
SHA1
ea53570bcbeb6874948dda79308967f2441202f4
-
SHA256
aca4b37b0b9bcfe1130d019005855af75cdc9e65afa50c2f40fc81ec3334879c
-
SHA512
3e095dce97d4d51b4becf07e07f45e13a6b3461d90ef4e79531d6b055dbd5ed0a0fc89e5ee892171cd2e3291030eb886bb043e8ba68dd5034fefc254be096b06
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 9 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ID to Token.py"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ID to Token.py2⤵
- Modifies registry class
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Public\Videos\Sample Videos\Wildlife.wmv"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
468KB
MD5bb4c176e39941f70451c9bb2f2d8e868
SHA1f3cab3c11bd4978d58ef0ec9c865e6b587b6f45c
SHA256c9e2387cdf3bc9b4b73361c34aac355ca5b1adea695e54b494999d586e5f60be
SHA51234ddb1cee780cb3607046a0511d6fb85352f7eafd33c67c30db90891fb912c51b03a356a36b914c33993ed80a28e927667cceffd24df9694c54920ed31de7261
-
Filesize
707KB
MD5a3c58e7a33a8e04cec329136107761ae
SHA1d0e8c82db5ec4a98205a7698bcd66db197d2dcd9
SHA256837b4d10402b2b083ebffae2f56cf0eee60cce17ad1f8a0dadd6a0d25b1bd5f6
SHA512c46663b1ab8928b4f48af95badd4f50870eaba2a90b3540deb71692bdb600d6c071c44dfb998ed995c6605fb3f940973700eceef7eebb6ea5503d25148662401
-
Filesize
400KB
MD586f021ee1ea355ba27f47ad4e84830f8
SHA1ec434cf59196a2be54b2f257b1818e990207ca5a
SHA2566c2ee30c2508d3bba8582b3bc61217a95cfb46758b288a5371ffb02bc224a03f
SHA512536c74c913d9f0bb9c91272913806f1d4d8b5cfae15a7ded4ae6450f176ef1d57d9a9bba0d45f8852811007d9aa292e23a59c528ae77de8dc7b8d548d0d5cf86
-
Filesize
417KB
MD5eee84dede93d836bf6379362d1fc1ca7
SHA15b22aadea2c1f27baf81c5514ee3a454fa456f38
SHA256a113203afa8b7e370d9d821ce0af2594b4453fe3ec9ed30783b986c7dac4a6b9
SHA51237e5fabb73da97df0d2107ab4628149bccd6c0e75b1651d25c740ad74218434745697476bbc650120b461322191e6917b07045ec2498ee8e5df37f511530194c
-
Filesize
673KB
MD5c683730136c7e38a88023bfba7a2f87b
SHA1e70b891218c25741879f6a953d5a066d9b1f3c95
SHA25602109712720e9ecafd692ffd1c8fb3c00a253e03f9ddde7e77070cd639d5c21c
SHA512655a33feb449088b27588e02d1f883e3b9fdb38595f1ae8c3da06884e7a0eaa4a11d95bab231cc5c4b2bb011b05466ac3f395f23d607f95b2a15807a32acbefb
-
Filesize
512KB
MD5f764e17e3641f529da1aff795e63131f
SHA1b4537b0c8b9147565da743c7866dbda5e36409c5
SHA2564f1bd8c9a69450f7021e93e043ec07e3c8abaa6da4f687fbe47309b612ff775f
SHA51284e8242ab77445fb7cb1d5e5e4d6310a79508371d03155eae3c233fd0c3690711fc569726cc39ec174441a20183de676a7d3dadf1143daf7178191c836e90050
-
Filesize
434KB
MD55e2a111968cf335bdaae84645becae3b
SHA12a016d824d42f3f731358a05f4c6859484d4542a
SHA2563e45a0feae07e5e602ba808bf0f2b498a94347c06602c8ec20b9369697ab238a
SHA512b8fde6c460740de6a832dd7877e60b4e1b192f90a0440cb03f32e623f4764a81e75d37cd95cd1b9a0ba286292be6f0d65d866d4c2c24ca0bf0333e87eba46060
-
Filesize
426KB
MD549b09cd209d8cbeb3098e2597e50b7db
SHA1c4dbfcaf8b7f158149761d44921093b3f3719321
SHA256ca044eceb365b2390da81794791879283e32ef43806b62d61866abdd2db5d892
SHA51244d363364938f13e80d5415073b8707cb8d23ccfaec859429bfb30192aacf75e4a0a3db21b5b778801d253414b2ea9a8f57137c39991b70e942b29ad4c3a39db
-
Filesize
384KB
MD556d55bc20eb7ee93afe95c73f12fc759
SHA11824ce192519d0b08441b8ef470a9f58ef246b81
SHA2561c57c355e3876260aca38a87264cb256fa1dcde41bc67f1e7c59c71404f44dbd
SHA5122caa481281fc8fc8ca52a95d94b17d6ef24eff0708860b0d0269c1ca0648e0132bb0e581b065c3e6b5f0603bc62d39c6f84da8cae2da56a07f9f20d8b72eb707
-
Filesize
247KB
MD5a351b27550285304c4cbc5b382817bba
SHA16daaafc48f78e08a11206ffec2d88b0b40c3fcde
SHA2563f8df00a02e2d36ea4ce74d8a3fb817e38c2bb0c25cf8e9ac74d51911775cfda
SHA512d94aa97f555f427069e0fa4a063da91cd275ae8f26d3c3fda51ff61fb4d1b9c8dee3085c1f8eabb5fdbf3bb1d7968fd5e99287553815e390be613b0fb94e55c6
-
Filesize
256KB
MD5d958a66515833fe6839a1550735f6b15
SHA103f44de65306df1255e6691f239736a076854fc9
SHA2562d3f63addcc67df8bf34409bdf192b2bca9dacbaa62eb14e513cd1766732064e
SHA5127397bcd8157c326c4889b7a7ba054dd6e3dc3520f5a2384fe71d694b924ca5968993c662513a812d6d704d80664ebce5ffe951deca4e97e5c915b21787e58e22
-
Filesize
11KB
MD5129c360e9be72f3fefe8847cae3b4ef3
SHA10dda2448aeeceb6fad7297ad80ace78cdc608ea2
SHA256b8b45cd59376160ea9daf175bda4f1622636a52a28c1aa499efd15b1000bb821
SHA5122de6ffa69b0ea8a1980da65772e691361d5e2721d1c36c69c92c8f50479052127824d0bc7dd7fc98f1715b5331b8a3b532228151d433c0028f5753b340cc8264
-
Filesize
281KB
MD544da6ff95a923e040f9e127356f54ce0
SHA1375dd2d9f08e29195ad04bb9accaff5fb7744ecc
SHA2563978630a88cbf2117d5a3672eb40edb75dea15fa08475bbbf96db78105be287a
SHA512761cd578f324d0d9393deb962e0d4aab93d2483acb2bab1661d116fa4546e884f1d5baf2a6c028468a6b915408e74f5455da89974c0c578a38a1e433419a0886
-
Filesize
2KB
MD5f9d66b494933f82f4c68dd2a313f9f32
SHA119b725b4bf7cf939b83b1d963e12f7d243c4aa20
SHA256957fbd0de7aaaa2111b19889fd4a4a2d9cab5f7accaa7d3774052b6a53dbbf3c
SHA512b9191721a21e2c44b28b2f40648f834207526ec2f41943a1d1a2fc7b656f730e6a07c9c7886551c2e2562c6cd89597ac4e6fea0d82e984c3904c4011076562c2
-
Filesize
571KB
MD599fd728ac9243992d783b8378fc74d48
SHA1b095dc4803d2c8df8741a9390cd278b7596e6e87
SHA256e1923e2a789d734aa7808fd63c1317d64b31f600166e6fc8e7dfe4d37581e7c4
SHA51225f30804b7c976f06dd5872bca7088eb160cb22d58b17cc71712d7d07c1176254935597d36f1e44da29e9baad9276646f4a2f7cf57fbb62c24cb75e85655a35e
-
Filesize
349KB
MD53e00856d20a0ba460baf4c3066707097
SHA1446ee00e8d03401bebaa25de63c2def3986f3c3c
SHA2561d108d52705e264dbb26a8b5ae013d52a40bbed7aa3615d4fd436e8fc601e193
SHA512934a1ad0a515453c758c629d937e1fb93eba475f8abbcf34dc61ae84ab31665500ee392f1a6dde1e4ba6a7ce8ca4fd6b2018dbc88b35b7c4bbf6ece35c87f469
-
Filesize
298KB
MD5fc004d15e98ec93bea6330da6a769a49
SHA19d17e60bf835977e0d3a118816ec81dc4d880681
SHA2566f0e6d6e49f5eef5afcd5d946a64b492f60825eb27a2c6ea942d0d8ba3bf7626
SHA5126fbf6fd07bea60a9be75f798894a095a7c0bf60af39f7bd75ac7666e31f95497031d80f2ddb5b57d67160fc236dc833a5ea75ba6664a08e3c0f904b8d03c6221
-
Filesize
383KB
MD59191f5adbfdd986e247131e254c3c260
SHA1e661f85e3ae466c204edab75111d342d5fd320fd
SHA256fb2dae3af26bad038ec249c5a0eb22257254a260a8165ae0df434a7bb4d719f0
SHA51273795e1373621a0c3e6e3f1b3b997a1eaf096350a487cbac4f13deee50d891d337989140df7c287c0a52107f6765b567311224d14a7f25f3fec9918fc5298c35
-
Filesize
315KB
MD59d4fc5ec0b8987c50cfff210fb3aa0ee
SHA17a5c6a75fef7b51877e7e012d0af6a03ba1d1e3f
SHA256ffca3afeaad3a625fa5d26f0a9ac051ba1e1d19db4abfa83c0be55b61c9aaaa3
SHA512d9f240fe4bed22c6cb2ce72f2e60657f1903bd4a53b4ba3cf0ca17b234f3d34f45789443257b6c88a46f3779fdb7faadbc17e60614eb99b251ea15f08b3ce872
-
Filesize
502KB
MD5d3cd65f43e20ee438640f32a231430be
SHA1ac6d4807e9d109f6cdc861416eb867d45c907954
SHA256e30377f21241f390047020ef1ae2322b2810c5cedb56d6f5c0a9ce2775ad77ae
SHA512f3457703c348bf82fff08812a49a0254e2b68e0a7455d5a21c8a6f6ba8f6eb82e3ab884a97fd6eb2dedb446615323e6cc7e8d53a123e9c04bd22c1e88dfedec1
-
Filesize
332KB
MD594d2b91a59ba0dac63359df3cf67639e
SHA10b65dde9830d9019ec056c540b332237222afb51
SHA256354eba87eec347682a16b9ffd9141987353269ea4f49f8ef150229d1c97250b9
SHA512788e14d898e52ab63d1f3ab8de0220d37cbd8557ae753a48a3815632ed79d25ec5309867a97eca3364e436738783ba082a17e3a2d01809899a75a9bbbfca18a5
-
Filesize
366KB
MD57b94018a00ac277378a8a114dc1c9364
SHA1bc68c2033fc5eb5e28eda9a6966c58f243cb9f01
SHA256bafbfb76a3420ac8c6c0bba8d69e2b7fe54216fed790a1484bc9231612607ace
SHA5123c53816eec7420031645d2e385db1125a48d46974f3bb8c49165ff733a01dc78a3df7b39e5d994703d1748da625e3f8ef271ecc9d8f314bf07805cc2b93c4e8e
-
Filesize
485KB
MD5c0377282e38b75268e11212b564e9283
SHA1c31e6dacbfc776fd2371980f35273cfb55f1449d
SHA25608f6206faf86bf0609fb67ff90e7936de1634aab8c9ec2a9dc92d8eb8b1e8366
SHA512b6984c4f62d3c9e5cd7118464ba65ce8c6ae85094b49e137bfefe316a33f789c8f9c5d45125a0795861ab57100797ab11a2ea2f56da9ad993a90373773a44db8
-
Filesize
1KB
MD5cd0938d08170c489cfa01afc9f7cca66
SHA14abf4553c348873720475d17773d256b98e5a6e1
SHA256d0c25e514b03316bca560aceca549e4d30af16506c3b4abe0e3e64e0df28ff2f
SHA512ff263e36694ef32d679766a6abbe717fe5fa85655f89b64b698f6cdaa174a90dbb25f2272c1251bb58c6bf70bfef60e6a8e83f524a1a7a4aaa44e2bfc35944c4
-
Filesize
931B
MD599ee9617a7072ad10c9f05204de884d6
SHA17b02e1aa1e8557161910849f7c2f9265de3445ab
SHA2564c80946033ffa6a92d19f30e6db55ab47345f578b256d58b2ecd179f16084271
SHA5120ba8db19628b959bbb354af6254d2fd92d2ccf9c14cf0cb04a9dabe3595c239d397b77f8b5862401ec8b22130ddcf5e6e4b43ff7a5f6fd820c4977d1a55a02ac
-
Filesize
2KB
MD5390ede5d672f6c64f8c4b710aeff15ed
SHA137d1230623bc8ecfe10008ff3a73da5c71b32536
SHA256874c542c773c53b35e278c0c17d58d4d04e1a9a73a49b328b07ec5131174cbb4
SHA512d0a705b02f29947819ba3efaf669eb8b9efc2caacea11f09de2f6540f355bbf0fa005edbd9a3b8ec99ab50f3d4adf602278ecb2ea7bb43129b0919168933b14d
-
Filesize
878B
MD59cbc1c9647cd78c14c389b5e9ab9ac48
SHA18577fe04bdf7136757458deb8e82814818704caf
SHA256996616841baa389f61cd11c6ca01a12db1bfe60d04b7df32dd9870193893a7ed
SHA5128059d230252e88aa74abec987616ac5500e5f0ff8bad9b196fafb9d3690651c8f68230a877bb4d30ef7b03d857af170207c6ee99ca7d5978f6a9b42730a7c739
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
2.7MB
-
Filesize
96KB
-
Filesize
68KB
-
Filesize
92KB
-
Filesize
68KB
-
Filesize
92KB
-
Filesize
116KB
-
Filesize
2.0MB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
96KB
-
Filesize
132KB
-
Filesize
252KB
-
Filesize
68KB
-
Filesize
16.7MB
-
Filesize
992KB
-
Filesize
412KB
-
Filesize
192KB
-
Filesize
756KB
-
Filesize
320KB
-
Filesize
80KB
-
Filesize
76KB
-
Filesize
436KB
-
Filesize
392KB
-
Filesize
468KB
-
Filesize
788KB
-
Filesize
88KB
-
Filesize
68KB
-
Filesize
208KB
-
Filesize
64KB
-
Filesize
92KB
-
Filesize
1.5MB
-
Filesize
144KB
-
Filesize
160KB
-
Filesize
344KB
-
Filesize
68KB
-
Filesize
444KB
-
Filesize
192KB
-
Filesize
96KB
-
Filesize
68KB
-
Filesize
23.7MB
-
Filesize
264KB
-
Filesize
72KB
-
Filesize
1.4MB
-
Filesize
72KB
-
Filesize
80KB
-
Filesize
76KB
-
Filesize
84KB
-
Filesize
72KB
-
Filesize
108KB
-
Filesize
76KB
-
Filesize
168KB
-
Filesize
976KB
-
Filesize
76KB
-
Filesize
140KB
-
Filesize
84KB
-
Filesize
2.1MB
-
Filesize
2.3MB
-
Filesize
348KB
-
Filesize
1.4MB
-
Filesize
304KB
