Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
16-03-2024 15:13
General
-
Target
a9053a3a52113698143a2b9801509c68d0d8b4b8208da453f0974547df0931bc.exe
-
Size
703KB
-
MD5
43478841baa4b8754f75516220e33ac3
-
SHA1
2585a613129d7e3dbff3eb16b10ce3fe940c99a3
-
SHA256
a9053a3a52113698143a2b9801509c68d0d8b4b8208da453f0974547df0931bc
-
SHA512
9441209433e2d3d49012431011048cd33a7ce980482658a0b1e2ccd3baa70524d2585901b6130d4644d7ca0139d881a9f11a933949ed39ad805a147694b37f87
-
SSDEEP
12288:C6JZ+UD5+1fpL2ikTgmPb2EdVu/BdmSHqDd6bhW2RJV7uikFg:JEUD52fpL2bgmSEds/BnKQPlubg
Score
7/10
Malware Config
Signatures
-
Drops startup file 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9053a3a52113698143a2b9801509c68d0d8b4b8208da453f0974547df0931bc.exe"C:\Users\Admin\AppData\Local\Temp\a9053a3a52113698143a2b9801509c68d0d8b4b8208da453f0974547df0931bc.exe"1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1848-0-0x000007FEF5A60000-0x000007FEF63FD000-memory.dmpFilesize
9.6MB
-
memory/1848-2-0x000000001AD90000-0x000000001ADE2000-memory.dmpFilesize
328KB
-
memory/1848-1-0x0000000001E20000-0x0000000001EA0000-memory.dmpFilesize
512KB
-
memory/1848-3-0x000007FEF5A60000-0x000007FEF63FD000-memory.dmpFilesize
9.6MB
-
memory/1848-4-0x0000000001E20000-0x0000000001EA0000-memory.dmpFilesize
512KB
-
memory/1848-9-0x0000000001E20000-0x0000000001EA0000-memory.dmpFilesize
512KB
-
memory/1848-11-0x0000000001E20000-0x0000000001EA0000-memory.dmpFilesize
512KB
-
memory/1848-12-0x0000000002660000-0x0000000003660000-memory.dmpFilesize
16.0MB
-
memory/1848-13-0x000007FEF5A60000-0x000007FEF63FD000-memory.dmpFilesize
9.6MB
-
memory/1848-14-0x000007FEF5A60000-0x000007FEF63FD000-memory.dmpFilesize
9.6MB
-
memory/1848-15-0x0000000001E20000-0x0000000001EA0000-memory.dmpFilesize
512KB
-
memory/1848-16-0x0000000002660000-0x0000000003660000-memory.dmpFilesize
16.0MB