Analysis
- max time kernel
150s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
03/03/2024, 03:36
General
- Target bb15d0c336f73fc9c8fe1d675a218fb9.exe
- Size 1.3MB
- Sample240303-d565aacf95
- SHA256 ba851696e371fb5168687c362a74bbca8f3a09fa5b7999f9c7b5294b39f2e92c
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bb15d0c336f73fc9c8fe1d675a218fb9.exe"C:\Users\Admin\AppData\Local\Temp\bb15d0c336f73fc9c8fe1d675a218fb9.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/628-2-0x00000202D3980000-0x00000202D39B4000-memory.dmp
memory/628-5-0x00007FFADEA50000-0x00007FFADF511000-memory.dmp
memory/628-6-0x00000202EC3F0000-0x00000202EC400000-memory.dmp
memory/628-7-0x00000202EC3F0000-0x00000202EC400000-memory.dmp
memory/628-8-0x00000202EC3F0000-0x00000202EC400000-memory.dmp
memory/628-9-0x00000202F1B60000-0x00000202F1B68000-memory.dmp
memory/628-10-0x00000202EDC90000-0x00000202EDCC8000-memory.dmp
memory/628-11-0x00000202EDC60000-0x00000202EDC6E000-memory.dmp
memory/628-24-0x00007FFADEA50000-0x00007FFADF511000-memory.dmp
memory/628-25-0x00000202EC3F0000-0x00000202EC400000-memory.dmp
memory/628-26-0x00000202EC3F0000-0x00000202EC400000-memory.dmp
memory/628-27-0x00000202EC3F0000-0x00000202EC400000-memory.dmp
memory/628-28-0x00000202EC3F0000-0x00000202EC400000-memory.dmp
memory/628-29-0x00000202EC3F0000-0x00000202EC400000-memory.dmp