Analysis

  • max time kernel
    147s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/03/2024, 16:07

General

  • Target

    ae4ffdd6e3c5eb0b0f43e9207508a047b254d117b24779b29f882fd1ade8ad36.exe

  • Size

    716KB

  • MD5

    8f018fea9deea4bf8b2534602664d923

  • SHA1

    e415ee8962fc61d62b00ad23972b176ea9ff6314

  • SHA256

    ae4ffdd6e3c5eb0b0f43e9207508a047b254d117b24779b29f882fd1ade8ad36

  • SHA512

    f627033b0e06ce3a63b29a9f46eb8bf2c2a39a87feec701a9d5698fc6da757664f19061ed96cf20c6122355bf60b3038c4252c765580a9b0bb5af8ad3f3d044a

  • SSDEEP

    12288:u3P/aK2vB+sPStDCf7O4TsH+mGadTSdZKKQWOs5NgsPjYc+igyjj6n4zaj:u/CKABBbpT0rdwQWOwN7PPpgyqn4zS

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ae4ffdd6e3c5eb0b0f43e9207508a047b254d117b24779b29f882fd1ade8ad36.exe
    "C:\Users\Admin\AppData\Local\Temp\ae4ffdd6e3c5eb0b0f43e9207508a047b254d117b24779b29f882fd1ade8ad36.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    PID:3760
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    PID:3696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\System32\alg.exe

    Filesize

    661KB

    MD5

    70edfbb969e5bca212f3f31021cd3348

    SHA1

    6e1be6311e49936e5796107aa0a13b140d372d4d

    SHA256

    96f3237664ba485bc50b052fc93a2535e8f8e933712fbed9adc1d8764be66174

    SHA512

    447dbda1ea198dd4b5a1831eb24fa0882fba9cfd0f3921f627157567b1db9f3e88823d342565d1c8c4e87eb4167ac049560b96b01b073ae534e17f0220907e25

  • memory/3696-12-0x0000000140000000-0x00000001400AA000-memory.dmp

    Filesize

    680KB

  • memory/3696-16-0x0000000140000000-0x00000001400AA000-memory.dmp

    Filesize

    680KB

  • memory/3760-0-0x0000000000400000-0x00000000004B8000-memory.dmp

    Filesize

    736KB

  • memory/3760-1-0x0000000000780000-0x00000000007E7000-memory.dmp

    Filesize

    412KB

  • memory/3760-6-0x0000000000780000-0x00000000007E7000-memory.dmp

    Filesize

    412KB

  • memory/3760-7-0x0000000000780000-0x00000000007E7000-memory.dmp

    Filesize

    412KB

  • memory/3760-15-0x0000000000400000-0x00000000004B8000-memory.dmp

    Filesize

    736KB