Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
02-03-2024 20:19
General
-
Target
Ransomware/eda2.exe
-
Size
208KB
-
MD5
9ed4b9ace2563ce02973e94999e5081e
-
SHA1
7c69fd4f8650370ce07d18436ee4a44185f4f529
-
SHA256
fa2a9561a0cfc535908b8b39168391d4f87c685e8d95f52a51d194cc7264ba37
-
SHA512
6d48b956cbfc2d1a27a89e082bd7f914b5aeac8e00339a961cd1a18bab860185a64bb471f71e69e4bd1cacb801f57df140dffe7fd6b5b007eb2ec4b5540f8031
-
SSDEEP
3072:etRM+lmsolAIrRuw+mqv9j1MWLQ5MTmmsolNIrRuw+mqv9j1MWLQ5:1+lDAArTmDAN
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ransomware\eda2.exe"C:\Users\Admin\AppData\Local\Temp\Ransomware\eda2.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4020-0-0x0000000000420000-0x000000000045A000-memory.dmpFilesize
232KB
-
memory/4020-1-0x0000000074990000-0x0000000075140000-memory.dmpFilesize
7.7MB
-
memory/4020-2-0x0000000005410000-0x00000000059B4000-memory.dmpFilesize
5.6MB
-
memory/4020-3-0x0000000004E60000-0x0000000004EF2000-memory.dmpFilesize
584KB
-
memory/4020-4-0x0000000005010000-0x0000000005020000-memory.dmpFilesize
64KB
-
memory/4020-5-0x0000000004FF0000-0x0000000004FFA000-memory.dmpFilesize
40KB
-
memory/4020-6-0x0000000074990000-0x0000000075140000-memory.dmpFilesize
7.7MB
-
memory/4020-7-0x0000000005010000-0x0000000005020000-memory.dmpFilesize
64KB
-
memory/4020-8-0x0000000005010000-0x0000000005020000-memory.dmpFilesize
64KB