Analysis
-
max time kernel
149s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
24-02-2024 02:42
General
-
Target
a0bd3e3b9cf473adf3fedcdfb41782aa.exe
-
Size
185KB
-
MD5
a0bd3e3b9cf473adf3fedcdfb41782aa
-
SHA1
03a29032fe32a9eec1208a053065e1eab0cf6956
-
SHA256
33fd1c532349d48de6f33628e6b2fb68613f20ae297f4c7f7a3d705c90c691a1
-
SHA512
ce3a8c82db4102abf6833a4467f3f22b697eee13702e6cb35543161a2605b26b566b4be142b2560af2e5c7994c7be99a96520b5b176f49f3a4013c74dad20b87
-
SSDEEP
3072:sYH3BbCXHTkGA35sqZH9Wu4R8EcmXn0bmlICrx73xMxRaSIR7gLih88k:sm3dCXYGA35s9RpLxl9obNIR7hh88k
Score
7/10
Malware Config
Signatures
-
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0bd3e3b9cf473adf3fedcdfb41782aa.exe"C:\Users\Admin\AppData\Local\Temp\a0bd3e3b9cf473adf3fedcdfb41782aa.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
4KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB