Analysis
- max time kernel
149s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
05/03/2024, 10:12
General
- Target b471afb4d7491dfb6a648649071cfaec.exe
- Size 35KB
- Sample240305-l8r4jadb99
- SHA256 d46248da9a0df19f154abda2dec68c7657245888c015cc5bb0c7257624ae1ec0
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b471afb4d7491dfb6a648649071cfaec.exe"C:\Users\Admin\AppData\Local\Temp\b471afb4d7491dfb6a648649071cfaec.exe"1⤵
- Adds Run key to start application
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
store.jfm
memory/4120-0-0x0000000000400000-0x0000000000422000-memory.dmp
memory/4120-1-0x0000000000400000-0x0000000000422000-memory.dmp
memory/4336-52-0x000001CF2D410000-0x000001CF2D411000-memory.dmp
memory/4336-54-0x000001CF2D410000-0x000001CF2D411000-memory.dmp
memory/4336-47-0x000001CF2D410000-0x000001CF2D411000-memory.dmp
memory/4336-48-0x000001CF2D410000-0x000001CF2D411000-memory.dmp
memory/4336-49-0x000001CF2D410000-0x000001CF2D411000-memory.dmp
memory/4336-50-0x000001CF2D410000-0x000001CF2D411000-memory.dmp
memory/4336-51-0x000001CF2D410000-0x000001CF2D411000-memory.dmp
memory/4336-30-0x000001CF24E40000-0x000001CF24E50000-memory.dmp
memory/4336-53-0x000001CF2D410000-0x000001CF2D411000-memory.dmp
memory/4336-46-0x000001CF2D3E0000-0x000001CF2D3E1000-memory.dmp
memory/4336-55-0x000001CF2D410000-0x000001CF2D411000-memory.dmp
memory/4336-56-0x000001CF2D410000-0x000001CF2D411000-memory.dmp
memory/4336-57-0x000001CF2D030000-0x000001CF2D031000-memory.dmp
memory/4336-58-0x000001CF2D020000-0x000001CF2D021000-memory.dmp
memory/4336-60-0x000001CF2D030000-0x000001CF2D031000-memory.dmp
memory/4336-63-0x000001CF2D020000-0x000001CF2D021000-memory.dmp
memory/4336-66-0x000001CF2CF60000-0x000001CF2CF61000-memory.dmp
memory/4336-14-0x000001CF24D40000-0x000001CF24D50000-memory.dmp
memory/4336-80-0x000001CF2D170000-0x000001CF2D171000-memory.dmp
memory/4336-78-0x000001CF2D160000-0x000001CF2D161000-memory.dmp