Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/03/2024, 10:24

General

  • Target

    b8812904ce915084f0b26d9abc670a42.exe

  • Size

    111KB

  • MD5

    b8812904ce915084f0b26d9abc670a42

  • SHA1

    4991de56c478e67c2169c056c798c17ba682a41b

  • SHA256

    638dd001fb9eaa22abba25300832c7ac1ddbc4c22d2f704a770cf711220ff237

  • SHA512

    e96d4fdba40028d4577f534112ba495b612c53fbecf8947e4fbdbc9f9dd838b7a42eb06d7435322d999862dbd27d925dd9893b875ffe11ed43922c273835c528

  • SSDEEP

    768:VSSH1lqiNlFndQA65WaGTZIXQ0W1BbuU2C0Ol6mFrw2hgfUXIWMkNL3iW+ndC0Jl:VwUFdO5WWWH27OIQrH+fZWL/OJQBa

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b8812904ce915084f0b26d9abc670a42.exe
    "C:\Users\Admin\AppData\Local\Temp\b8812904ce915084f0b26d9abc670a42.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4872

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/4872-0-0x0000000000CB0000-0x0000000000CD2000-memory.dmp

          Filesize

          136KB

        • memory/4872-1-0x0000000001480000-0x000000000149A000-memory.dmp

          Filesize

          104KB

        • memory/4872-2-0x00007FFA8BA20000-0x00007FFA8C4E1000-memory.dmp

          Filesize

          10.8MB

        • memory/4872-3-0x000000001BAE0000-0x000000001BAF0000-memory.dmp

          Filesize

          64KB

        • memory/4872-5-0x00007FFA8BA20000-0x00007FFA8C4E1000-memory.dmp

          Filesize

          10.8MB