Analysis

  • max time kernel
    139s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-03-2024 18:51

General

  • Target

    2222-main/token.exe

  • Size

    7KB

  • MD5

    a35189bbe526f95125f313585a23c091

  • SHA1

    571507b33c3bb4641562e86f66fab4068a807067

  • SHA256

    97ffdd15bd339158c3569a1183d8d42250932c262a570bf230db6e741b5eb815

  • SHA512

    b233916b3c56bf62098cda4a82f3e234ce9dbe20d60d055d6743464d0d75ab4890006327ea45c8f38f08284616f01f373ebe2a260b75cc1d0a74e2dae42169c5

  • SSDEEP

    96:qGhDBU9ZsETvsxblLSP8+Uqngf02CyZcFKfgfdlfBzNt:qGcoET1P8+UqVwfgFlfD

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2222-main\token.exe
    "C:\Users\Admin\AppData\Local\Temp\2222-main\token.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4608
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4608 -s 1976
      2⤵
      • Program crash
      PID:1876
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4608 -ip 4608
    1⤵
      PID:3080

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4608-0-0x00000000003B0000-0x00000000003B8000-memory.dmp

      Filesize

      32KB

    • memory/4608-1-0x0000000074E30000-0x00000000755E0000-memory.dmp

      Filesize

      7.7MB

    • memory/4608-2-0x0000000004DA0000-0x0000000004DB0000-memory.dmp

      Filesize

      64KB

    • memory/4608-3-0x0000000074E30000-0x00000000755E0000-memory.dmp

      Filesize

      7.7MB