Overview

overview

6

Static

static

3

Download me pls.exe

windows7-x64

6

Download me pls.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    142s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-04-2024 22:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Download me pls.exe

  • Size

    255KB

  • MD5

    0d9f5ae70d705fbe48aec4ec6df1aeff

  • SHA1

    bd127da95bb4665b723940494c63619c122edd8c

  • SHA256

    c7d814e4736079f73286423e78fc5318c68f5bc5e42219241d96a27b8fdd5db4

  • SHA512

    58965ba3bbb3e74db76522b4529b4afdf5a929cbab552a1a77f40c9e70805a37047179abdfe3125bcaf029a1a373b2f5a5703b34bc529a62a37c4589a9e7ea7c

  • SSDEEP

    6144:YCEYOm3Z3rvguA4y41Ttk0Boznob8t6N:H/OUbouA4y41vozH6

Score
6/10

Malware Config

Signatures

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Download me pls.exe
    "C:\Users\Admin\AppData\Local\Temp\Download me pls.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1972
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1328 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:780

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1972-0-0x00000000006E0000-0x000000000072A000-memory.dmp

      Filesize

      296KB

      Download

    • memory/1972-1-0x00007FFA35DF0000-0x00007FFA368B1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/1972-2-0x00000000029B0000-0x00000000029C0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1972-3-0x00007FFA35DF0000-0x00007FFA368B1000-memory.dmp

      Filesize

      10.8MB

      Download