3b2e708eaa4744c76a633391cf2c983f4a098b46436525619e5ea44e105355fe

Resubmissions

10/04/2024, 10:26

240410-mgws3sfd41 8

Analysis

max time kernel
149s
max time network
138s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 10:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b2e708eaa4744c76a633391cf2c983f4a098b46436525619e5ea44e105355fe.exe
Size

419KB
MD5

7d20fa01a703afa8907e50417d27b0a4
SHA1

320116162d78afb8e00fd972591479a899d3dfee
SHA256

3b2e708eaa4744c76a633391cf2c983f4a098b46436525619e5ea44e105355fe
SHA512

0dcebe2598e6ccb51f0609831c93071421049eb924f83871e95c5a280af0d2e76630dfc47c5a2780eb18d55ee9690d6c83aabd8f1043cc2cdc21d9fe5425b892
SSDEEP

3072:Ga1HoUY9aEnRUx4DZLQHkRduVhiHm5Pz6GaYtxcpKnyWOtq:GwYznRC4DpduVnxzsYtxWWOtq

Score

6^/10

Malware Config

Signatures

Drops desktop.ini file(s) 21 IoCs

description	ioc	Process
File opened for modification	C:\ProgramData\Documents\My Videos\Sample Videos\desktop.ini	3b2e708eaa4744c76a633391cf2c983f4a098b46436525619e5ea44e105355fe.exe
File opened for modification	C:\ProgramData\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	3b2e708eaa4744c76a633391cf2c983f4a098b46436525619e5ea44e105355fe.exe
File opened for modification	C:\ProgramData\Start Menu\Programs\Maintenance\Desktop.ini	3b2e708eaa4744c76a633391cf2c983f4a098b46436525619e5ea44e105355fe.exe
File opened for modification	C:\ProgramData\Start Menu\Programs\Startup\desktop.ini	3b2e708eaa4744c76a633391cf2c983f4a098b46436525619e5ea44e105355fe.exe
File opened for modification	C:\ProgramData\Documents\My Pictures\Sample Pictures\desktop.ini	3b2e708eaa4744c76a633391cf2c983f4a098b46436525619e5ea44e105355fe.exe
File opened for modification	C:\ProgramData\Documents\My Music\Sample Music\desktop.ini	3b2e708eaa4744c76a633391cf2c983f4a098b46436525619e5ea44e105355fe.exe
File opened for modification	C:\ProgramData\Documents\My Videos\desktop.ini	3b2e708eaa4744c76a633391cf2c983f4a098b46436525619e5ea44e105355fe.exe
File opened for modification	C:\ProgramData\Start Menu\Programs\desktop.ini	3b2e708eaa4744c76a633391cf2c983f4a098b46436525619e5ea44e105355fe.exe
File opened for modification	C:\ProgramData\Start Menu\Programs\Accessories\Desktop.ini	3b2e708eaa4744c76a633391cf2c983f4a098b46436525619e5ea44e105355fe.exe
File opened for modification	C:\ProgramData\Start Menu\Programs\Accessories\System Tools\Desktop.ini	3b2e708eaa4744c76a633391cf2c983f4a098b46436525619e5ea44e105355fe.exe
File opened for modification	C:\ProgramData\Documents\My Music\desktop.ini	3b2e708eaa4744c76a633391cf2c983f4a098b46436525619e5ea44e105355fe.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-2461186416-2307104501-1787948496-1000\desktop.ini	3b2e708eaa4744c76a633391cf2c983f4a098b46436525619e5ea44e105355fe.exe
File opened for modification	C:\ProgramData\Desktop\desktop.ini	3b2e708eaa4744c76a633391cf2c983f4a098b46436525619e5ea44e105355fe.exe
File opened for modification	C:\ProgramData\Documents\desktop.ini	3b2e708eaa4744c76a633391cf2c983f4a098b46436525619e5ea44e105355fe.exe
File opened for modification	C:\ProgramData\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini	3b2e708eaa4744c76a633391cf2c983f4a098b46436525619e5ea44e105355fe.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-2461186416-2307104501-1787948496-1000\desktop.ini	3b2e708eaa4744c76a633391cf2c983f4a098b46436525619e5ea44e105355fe.exe
File opened for modification	C:\ProgramData\Start Menu\desktop.ini	3b2e708eaa4744c76a633391cf2c983f4a098b46436525619e5ea44e105355fe.exe
File opened for modification	C:\ProgramData\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini	3b2e708eaa4744c76a633391cf2c983f4a098b46436525619e5ea44e105355fe.exe
File opened for modification	C:\ProgramData\Start Menu\Programs\Administrative Tools\desktop.ini	3b2e708eaa4744c76a633391cf2c983f4a098b46436525619e5ea44e105355fe.exe
File opened for modification	C:\ProgramData\Start Menu\Programs\Games\Desktop.ini	3b2e708eaa4744c76a633391cf2c983f4a098b46436525619e5ea44e105355fe.exe
File opened for modification	C:\ProgramData\Documents\My Pictures\desktop.ini	3b2e708eaa4744c76a633391cf2c983f4a098b46436525619e5ea44e105355fe.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1316	3b2e708eaa4744c76a633391cf2c983f4a098b46436525619e5ea44e105355fe.exe
Token: SeBackupPrivilege	1316	3b2e708eaa4744c76a633391cf2c983f4a098b46436525619e5ea44e105355fe.exe
Token: SeRestorePrivilege	1316	3b2e708eaa4744c76a633391cf2c983f4a098b46436525619e5ea44e105355fe.exe
Token: SeShutdownPrivilege	1316	3b2e708eaa4744c76a633391cf2c983f4a098b46436525619e5ea44e105355fe.exe

C:\Users\Admin\AppData\Local\Temp\3b2e708eaa4744c76a633391cf2c983f4a098b46436525619e5ea44e105355fe.exe
"C:\Users\Admin\AppData\Local\Temp\3b2e708eaa4744c76a633391cf2c983f4a098b46436525619e5ea44e105355fe.exe"
1⤵
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
PID:1316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1316-0-0x00000000011C0000-0x000000000122E000-memory.dmp

Filesize
440KB

Download
memory/1316-1-0x000007FEF5370000-0x000007FEF5D5C000-memory.dmp

Filesize
9.9MB

Download
memory/1316-2-0x000000001B1F0000-0x000000001B270000-memory.dmp

Filesize
512KB

Download
memory/1316-3-0x000007FEF5370000-0x000007FEF5D5C000-memory.dmp

Filesize
9.9MB

Download
memory/1316-4-0x000000001B1F0000-0x000000001B270000-memory.dmp

Filesize
512KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads