Analysis

  • max time kernel
    118s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10-03-2024 01:09

General

  • Target

    SecuriteInfo.com.Win32.TrojanX-gen.4983.29177.exe

  • Size

    12.6MB

  • MD5

    f134475ebee920480ccdd56cc41c84cc

  • SHA1

    85d8595940e98556246a27d2ea376636fa57238c

  • SHA256

    4ac269a19fbe26769c846742af30aec4de81abd75bb3bc546410fc83917c98ff

  • SHA512

    267ff856a1963db423c185ed9b0c53f57780937838af526719289932f4accb6ff9f506b7b210d01b16eee155fad0f8696f93b150d0523129b40beaef4187c087

  • SSDEEP

    393216:tb0luzfV0luzfNEWpRRVQta1aCdPGdNd:lLfVLfiWpWSaQ+dNd

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.4983.29177.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.4983.29177.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1084
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2280

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1084-0-0x000007FEF4AA0000-0x000007FEF543D000-memory.dmp

    Filesize

    9.6MB

  • memory/1084-1-0x0000000000450000-0x00000000004D0000-memory.dmp

    Filesize

    512KB

  • memory/1084-2-0x000007FEF4AA0000-0x000007FEF543D000-memory.dmp

    Filesize

    9.6MB

  • memory/1084-3-0x0000000000450000-0x00000000004D0000-memory.dmp

    Filesize

    512KB

  • memory/1084-22-0x0000000000450000-0x00000000004D0000-memory.dmp

    Filesize

    512KB

  • memory/1084-21-0x0000000000450000-0x00000000004D0000-memory.dmp

    Filesize

    512KB

  • memory/1084-20-0x000007FEF4AA0000-0x000007FEF543D000-memory.dmp

    Filesize

    9.6MB

  • memory/1084-19-0x0000000000450000-0x00000000004D0000-memory.dmp

    Filesize

    512KB

  • memory/2280-12-0x000007FEF4AA0000-0x000007FEF543D000-memory.dmp

    Filesize

    9.6MB

  • memory/2280-13-0x00000000029F0000-0x0000000002A70000-memory.dmp

    Filesize

    512KB

  • memory/2280-14-0x00000000029F0000-0x0000000002A70000-memory.dmp

    Filesize

    512KB

  • memory/2280-15-0x00000000029F0000-0x0000000002A70000-memory.dmp

    Filesize

    512KB

  • memory/2280-16-0x000007FEF4AA0000-0x000007FEF543D000-memory.dmp

    Filesize

    9.6MB

  • memory/2280-11-0x0000000002560000-0x0000000002568000-memory.dmp

    Filesize

    32KB

  • memory/2280-9-0x00000000029F0000-0x0000000002A70000-memory.dmp

    Filesize

    512KB

  • memory/2280-10-0x000000001B340000-0x000000001B622000-memory.dmp

    Filesize

    2.9MB

  • memory/2280-8-0x000007FEF4AA0000-0x000007FEF543D000-memory.dmp

    Filesize

    9.6MB