1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591 | Triage

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-02-2024 09:44

Sharing

Report Analysis Logs

General

Target

220522-ny66tadcdj.exe
Size

114KB
MD5

3f4a16b29f2f0532b7ce3e7656799125
SHA1

61b25d11392172e587d8da3045812a66c3385451
SHA256

1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591
SHA512

32acaceda42128ef9e0a9f36ee2678d2fc296fda2df38629eb223939c8a9352b3bb2b7021bb84e9f223a4a26df57b528a711447b1451213a013fe00f9b971d80
SSDEEP

1536:sBOoa7Nn52wurilmw9BgjKu1sPPxaSLyqC:sBOoa7P2wxlPwV1qPkSuqC

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

Processes:

220522-ny66tadcdj.exe

description	ioc	process
File created	C:\Windows\system32\Drivers\bpdr.sys	220522-ny66tadcdj.exe
File created	C:\Windows\system32\Drivers\bpdr	220522-ny66tadcdj.exe
File opened for modification	C:\Windows\system32\Drivers\bpdr	220522-ny66tadcdj.exe

Suspicious behavior: LoadsDriver 5 IoCs

Processes:

pid process

660
660
660
660
660

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

220522-ny66tadcdj.exe

description	pid	process
Token: 0	620	220522-ny66tadcdj.exe
Token: SeBackupPrivilege	620	220522-ny66tadcdj.exe
Token: SeLoadDriverPrivilege	620	220522-ny66tadcdj.exe

C:\Users\Admin\AppData\Local\Temp\220522-ny66tadcdj.exe
"C:\Users\Admin\AppData\Local\Temp\220522-ny66tadcdj.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of AdjustPrivilegeToken
PID:620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads