Analysis
- max time kernel
49s - max time network
17s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
28/03/2024, 15:06
General
- Target f8da280bb9f81028c14d1e156d6685cdb5f75219a60f645f72e520fb5e388712.exe
- Size 15KB
- Sample240328-sgx9sshb9x
- SHA256 f8da280bb9f81028c14d1e156d6685cdb5f75219a60f645f72e520fb5e388712
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Drops file in System32 directory 1 IoCs
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f8da280bb9f81028c14d1e156d6685cdb5f75219a60f645f72e520fb5e388712.exe"C:\Users\Admin\AppData\Local\Temp\f8da280bb9f81028c14d1e156d6685cdb5f75219a60f645f72e520fb5e388712.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
94308059B57B3142E455B38A6EB92015
Tar28EB.tmp
memory/2928-0-0x0000000000E90000-0x0000000000E9A000-memory.dmp
memory/2928-1-0x0000000074A50000-0x000000007513E000-memory.dmp
memory/2928-2-0x0000000004DB0000-0x0000000004DF0000-memory.dmp
memory/2928-40-0x0000000004DB0000-0x0000000004DF0000-memory.dmp
memory/2928-41-0x0000000074A50000-0x000000007513E000-memory.dmp