Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
25/02/2024, 04:35
General
-
Target
a2ebd7fe2f9753f954c293d6a0cabe66.exe
-
Size
288KB
-
MD5
a2ebd7fe2f9753f954c293d6a0cabe66
-
SHA1
56d824a6c1e10025267183897b3e406d3587c485
-
SHA256
43738796c32a07ac0c87cc779ab8ec1afc78822f8148b1faa08fae13861e7bad
-
SHA512
ab46995faacdaa66f962264c5d1f788505b2812c16e71604685137ee84a03f8577d8c93914251a6d5aece8cfd100291bd07d66bffa148c2f17af0303017c908b
-
SSDEEP
6144:Ep5WdB741An01p5WfMWFbCXCe0SNDCHyetwxSWnlhZ9E+RtmA9Btn6UW9Hv6SYcv:Ep5Wdp41An01p5YtShLE+Rtpvn6TJBY2
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in System32 directory 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2ebd7fe2f9753f954c293d6a0cabe66.exe"C:\Users\Admin\AppData\Local\Temp\a2ebd7fe2f9753f954c293d6a0cabe66.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msn_explorer.exeC:\Windows\system32\msn_explorer.exe C:\Users\Admin\AppData\Local\Temp\a2ebd7fe2f9753f954c293d6a0cabe66.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
288KB
MD5a2ebd7fe2f9753f954c293d6a0cabe66
SHA156d824a6c1e10025267183897b3e406d3587c485
SHA25643738796c32a07ac0c87cc779ab8ec1afc78822f8148b1faa08fae13861e7bad
SHA512ab46995faacdaa66f962264c5d1f788505b2812c16e71604685137ee84a03f8577d8c93914251a6d5aece8cfd100291bd07d66bffa148c2f17af0303017c908b