ae61ad1b14d79fe0754e354c6db69205ed2451bef4ec096afacb74f22a41315b | Triage

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 05:26

Sharing

Report Analysis Logs

General

Target

a10e75bd2e12bc4940f284d5e31086af.exe
Size

14KB
MD5

a10e75bd2e12bc4940f284d5e31086af
SHA1

90b5489c4f82e059031ecb80423114fb6f26b740
SHA256

ae61ad1b14d79fe0754e354c6db69205ed2451bef4ec096afacb74f22a41315b
SHA512

dbada5b7ead3eda8fa9d0e83a18d2cf85b98825953c749dde44d48326ff6dd448dc37cfd6e6c7275830293eb44f43ca7b7018f3511cf86cbeccc6530525384b3
SSDEEP

384:AGGnTOhC2V6GckWBMo6+WrPPsck4ICO48VCxkRJm7Ry8:bK2zo6/rHrECONCyQy8

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ldA6B0.tmp	a10e75bd2e12bc4940f284d5e31086af.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4076	a10e75bd2e12bc4940f284d5e31086af.exe
4076	a10e75bd2e12bc4940f284d5e31086af.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4076	a10e75bd2e12bc4940f284d5e31086af.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 640	4076	a10e75bd2e12bc4940f284d5e31086af.exe	3

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:640

C:\Users\Admin\AppData\Local\Temp\a10e75bd2e12bc4940f284d5e31086af.exe
"C:\Users\Admin\AppData\Local\Temp\a10e75bd2e12bc4940f284d5e31086af.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads