Resubmissions
09/04/2024, 13:27 UTC
240409-qqa5hsbd5t 1009/04/2024, 13:27 UTC
240409-qp978abd5s 1009/04/2024, 13:27 UTC
240409-qp9lpabd4y 1009/04/2024, 13:27 UTC
240409-qp9axsgb32 1018/11/2023, 14:44 UTC
231118-r4d9rsef94 10Analysis
-
max time kernel
361s -
max time network
364s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
09/04/2024, 13:27 UTC
General
-
Target
New Text Document.exe
-
Size
4KB
-
MD5
a239a27c2169af388d4f5be6b52f272c
-
SHA1
0feb9a0cd8c25f01d071e9b2cfc2ae7bd430318c
-
SHA256
98e895f711226a32bfab152e224279d859799243845c46e550c2d32153c619fc
-
SHA512
f30e1ff506cc4d729f7e24aa46e832938a5e21497f1f82f1b300d47f45dae7f1caef032237ef1f5ae9001195c43c0103e3ab787f9196c8397846c1dea8f351da
-
SSDEEP
48:6r1huik0xzYGJZZJOQOulbfSqXSfbNtm:IIxcLpf6zNt
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Text Document.exe"C:\Users\Admin\AppData\Local\Temp\New Text Document.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2100 -s 10722⤵
-
Network
-
DNSurlhaus.abuse.chRemote address:8.8.8.8:53Requesturlhaus.abuse.chIN AResponseurlhaus.abuse.chIN CNAMEp2.shared.global.fastly.netp2.shared.global.fastly.netIN A151.101.2.49p2.shared.global.fastly.netIN A151.101.66.49p2.shared.global.fastly.netIN A151.101.130.49p2.shared.global.fastly.netIN A151.101.194.49
-
151.101.2.49:443urlhaus.abuse.chtls
-
8.8.8.8:53urlhaus.abuse.chdns
DNS Request
urlhaus.abuse.ch
DNS Response
151.101.2.49151.101.66.49151.101.130.49151.101.194.49
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
9.9MB
-
Filesize
512KB