a0f6963845d7aeae328048da66059059fdbcb6cc30712fd10a34018caf0bd28a

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 13:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a0f6963845d7aeae328048da66059059fdbcb6cc30712fd10a34018caf0bd28a.exe
Size

10.4MB
MD5

529ba5d2c599a72bb56a4b66214af1ae
SHA1

a6bfe60170efd697ccca1e2e2dd7c6990e0bb90e
SHA256

a0f6963845d7aeae328048da66059059fdbcb6cc30712fd10a34018caf0bd28a
SHA512

138627c7d066f0ee6637be417def3821a70a844746866659e18bf374d105d6b3bef874f3a85e22a1faaaddf29b849ebc7214a611f7d4fec64954346d2750275a
SSDEEP

768:XnzHfh5s5+uBsI07a24msgjtQoIYlHqqlYcGYF2X3w2vf0DDe5MFgkaj7QUAc8Fc:Xrff4biIYlbaYFIHX0DSeFXan

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\gmailfame = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a0f6963845d7aeae328048da66059059fdbcb6cc30712fd10a34018caf0bd28a.exe"	a0f6963845d7aeae328048da66059059fdbcb6cc30712fd10a34018caf0bd28a.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1196	a0f6963845d7aeae328048da66059059fdbcb6cc30712fd10a34018caf0bd28a.exe
1196	a0f6963845d7aeae328048da66059059fdbcb6cc30712fd10a34018caf0bd28a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1196	a0f6963845d7aeae328048da66059059fdbcb6cc30712fd10a34018caf0bd28a.exe

C:\Users\Admin\AppData\Local\Temp\a0f6963845d7aeae328048da66059059fdbcb6cc30712fd10a34018caf0bd28a.exe
"C:\Users\Admin\AppData\Local\Temp\a0f6963845d7aeae328048da66059059fdbcb6cc30712fd10a34018caf0bd28a.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1196-1-0x000007FEF5870000-0x000007FEF625C000-memory.dmp

Filesize
9.9MB

Download
memory/1196-0-0x00000000003B0000-0x0000000000E24000-memory.dmp

Filesize
10.5MB

Download
memory/1196-2-0x000000001BEA0000-0x000000001BF20000-memory.dmp

Filesize
512KB

Download
memory/1196-3-0x000007FEF5870000-0x000007FEF625C000-memory.dmp

Filesize
9.9MB

Download