9a8ef14e16223b1972bc57009812a317d3275db0f86b7de0190a024511166301

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2024, 14:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9a8ef14e16223b1972bc57009812a317d3275db0f86b7de0190a024511166301.exe
Size

255KB
MD5

1384e187a6e9f077fdf60726f13969b6
SHA1

fdf52d39ccb47c1772948f6cd6302d5a9cf5c547
SHA256

9a8ef14e16223b1972bc57009812a317d3275db0f86b7de0190a024511166301
SHA512

44d5108ae1d7750eaf1b32a7fb5b78905bcf6514daea1523270adffaf8c2e1efeb5cf1483ddb792ec81756e4f134146475bf726b56151d3d82dbcaaee118f3df
SSDEEP

6144:uqUBSAkzL7r9r/EDppppppppppppppppppppppppppppp0Gb:uMP7r9r/+pppppppppppppppppppppp5

Score

9^/10

discovery

Malware Config

Signatures

Contacts a large (4554) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2556	9a8ef14e16223b1972bc57009812a317d3275db0f86b7de0190a024511166301.exe

C:\Users\Admin\AppData\Local\Temp\9a8ef14e16223b1972bc57009812a317d3275db0f86b7de0190a024511166301.exe
"C:\Users\Admin\AppData\Local\Temp\9a8ef14e16223b1972bc57009812a317d3275db0f86b7de0190a024511166301.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2556-0-0x000001B9B4240000-0x000001B9B4282000-memory.dmp

Filesize
264KB

Download
memory/2556-1-0x00007FFDE7270000-0x00007FFDE7D31000-memory.dmp

Filesize
10.8MB

Download
memory/2556-2-0x000001B9CE890000-0x000001B9CE8A0000-memory.dmp

Filesize
64KB

Download
memory/2556-5-0x00007FFDE7270000-0x00007FFDE7D31000-memory.dmp

Filesize
10.8MB

Download
memory/2556-6-0x000001B9CE890000-0x000001B9CE8A0000-memory.dmp

Filesize
64KB

Download