Analysis

  • max time kernel
    93s
  • max time network
    118s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-04-2024 18:19

General

  • Target

    2b3ed63e74773c5c040eba08bffcef0d43174d07749d023cdac13d82877f31a9.exe

  • Size

    1.4MB

  • MD5

    05030f99b7b8a97a8fe6216fc72f2312

  • SHA1

    10b772a3e28b3750a82954d212c27cad7f5976e7

  • SHA256

    2b3ed63e74773c5c040eba08bffcef0d43174d07749d023cdac13d82877f31a9

  • SHA512

    01d09e06cae02e732dbdaae98db4d2b195d0ada48d0893aff2a62e87ad472446f62d54ac4bb0cdb6451c578580755b8bb7bf5d6a61004894d51575b1bf98e2d0

  • SSDEEP

    24576:6srs14u4hZA3kAchviyUXp1AWl3WzrhMTtYkUcIUYtu0My:7rs14u4zSMhvLEAW4FMTKk3Wtu

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2b3ed63e74773c5c040eba08bffcef0d43174d07749d023cdac13d82877f31a9.exe
    "C:\Users\Admin\AppData\Local\Temp\2b3ed63e74773c5c040eba08bffcef0d43174d07749d023cdac13d82877f31a9.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\EasyLog.log

    Filesize

    916B

    MD5

    8dd5f2203d8b953ae8c70b8861aedd1c

    SHA1

    522e6ae5dca5820b0541f733ffc5e02a6e451bff

    SHA256

    634fb03ccae5e2b0f401ef23e04739791ffd89b126a44115ad615e4c34da7d3f

    SHA512

    f0e9633baeb45f6af3fc0205e0e5f2880e251348159b82f4641d4a5bb5842b07b77a8b6dd52e5d2fa0ba6a415e0b0b0eb8fe738fe2e9d1f548f127da31f74058

  • memory/2696-1-0x0000000140000000-0x0000000140160000-memory.dmp

    Filesize

    1.4MB

  • memory/2696-0-0x00000000020E0000-0x0000000002140000-memory.dmp

    Filesize

    384KB

  • memory/2696-7-0x00000000020E0000-0x0000000002140000-memory.dmp

    Filesize

    384KB

  • memory/2696-8-0x00000000020E0000-0x0000000002140000-memory.dmp

    Filesize

    384KB

  • memory/2696-22-0x00000000020E0000-0x0000000002140000-memory.dmp

    Filesize

    384KB

  • memory/2696-24-0x0000000140000000-0x0000000140160000-memory.dmp

    Filesize

    1.4MB