Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
13-03-2024 16:19
General
-
Target
c653c6fcc4ace44321b580f69feb0181.exe
-
Size
15KB
-
MD5
c653c6fcc4ace44321b580f69feb0181
-
SHA1
6b0ebf771a9083d02b2ebdd653053643e78e1c61
-
SHA256
ae0e9717df7d1834966bfdf3a3a3bb1eb994336e583152c82c10c701f62101a8
-
SHA512
a7bef9b0c9296a47eacfec3bd125e46d06c3997b6f4ed9a3aa26cc88909fde65a3771c8aa638bafa5a86f4035c3f05e5bca58422c4d9a29faa5d4fe56cd71d13
-
SSDEEP
384:jBhlE4u969Kx8veEoRn9KGuFaUa0s8BG/hze1fCWdQ7pH:jLqnmRoHufs8E/hze1fCfH
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\c653c6fcc4ace44321b580f69feb0181.exe"C:\Users\Admin\AppData\Local\Temp\c653c6fcc4ace44321b580f69feb0181.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory