Analysis
-
max time kernel
105s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28/03/2024, 22:02
Static task
static1
Behavioral task
behavioral1
Sample
7937b8b2b8cbfc139d43e5e8393e439cf2fc58c4ce848ff28601e5f83b235438.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7937b8b2b8cbfc139d43e5e8393e439cf2fc58c4ce848ff28601e5f83b235438.exe
Resource
win10v2004-20240226-en
General
-
Target
7937b8b2b8cbfc139d43e5e8393e439cf2fc58c4ce848ff28601e5f83b235438.exe
-
Size
2.4MB
-
MD5
834b48c2d1cb1e5b889a9d9022388f73
-
SHA1
3423f20fe7a7c283a433563fa391c6084350b71b
-
SHA256
7937b8b2b8cbfc139d43e5e8393e439cf2fc58c4ce848ff28601e5f83b235438
-
SHA512
49241de19a86336543d6bfcb91b46191e8319f732c72dcf870dd68621da9114935c2181e49bcfd42239406ddf5e975bbdc7597b65b021813203cb33d2e64662b
-
SSDEEP
49152:OauEgfZzmNyPI1qr+4etgNq2SxlcQ/56txGt48Xy0a:OZZpg1qGtgk2SXb56txGt4+yR
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4780 7937b8b2b8cbfc139d43e5e8393e439cf2fc58c4ce848ff28601e5f83b235438.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4780 7937b8b2b8cbfc139d43e5e8393e439cf2fc58c4ce848ff28601e5f83b235438.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7937b8b2b8cbfc139d43e5e8393e439cf2fc58c4ce848ff28601e5f83b235438.exe"C:\Users\Admin\AppData\Local\Temp\7937b8b2b8cbfc139d43e5e8393e439cf2fc58c4ce848ff28601e5f83b235438.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4780
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\FXTT\7937b8b2b8cbfc139d43e5e83_Url_fwaxxshcncds0fxtp23efzspjvwv4elt\2.2.26.0\user.config
Filesize875B
MD5553636724737de5a9ba81a82d1d49e19
SHA1dd8238fd7c21db7532020d5d4aeec472060d9869
SHA256c7c5d23fb4e03c8cfa7bc80e45f62ea635b1a0f17b13409b80e70637ea244ede
SHA51219b8b58285018a305d215e1290bb66fecc2c29f68d4a7422488b8a113fb8c147f391f2ee8f2346822af3827485f8bec0b46bb38dc5457b6504029e43d40820a3
-
C:\Users\Admin\AppData\Local\FXTT\7937b8b2b8cbfc139d43e5e83_Url_fwaxxshcncds0fxtp23efzspjvwv4elt\2.2.26.0\user.config
Filesize9KB
MD5f06fc1304e5600b2328241cf05d37e3b
SHA13547b245311776a9ce849c52277ecd202e448b2c
SHA256e932b01ccac069a7a68a4e0db7cb976fb39f5718076e8dbb4c4ad5195de66b77
SHA5127fc7b29f981749c652c4eac2e5954159a2fd5da9c5571e6602766985edc77668a937abfcce9a5345f8c27eb27b8e3a15cd7e4cc71809b9b3bb6efb8e30c54f79