Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
24/04/2024, 23:13
General
- Target 747f2f13e487ddbcbb700eb052fbd06f2469ab8ee90f85d71daee264d2b814fa.exe
- Size 65KB
- Sample240424-27thzabd4v
- SHA256 747f2f13e487ddbcbb700eb052fbd06f2469ab8ee90f85d71daee264d2b814fa
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\747f2f13e487ddbcbb700eb052fbd06f2469ab8ee90f85d71daee264d2b814fa.exe"C:\Users\Admin\AppData\Local\Temp\747f2f13e487ddbcbb700eb052fbd06f2469ab8ee90f85d71daee264d2b814fa.exe"1⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1044-0-0x00000195E4E60000-0x00000195E4E70000-memory.dmp
memory/1044-16-0x00000195E4F60000-0x00000195E4F70000-memory.dmp
memory/1044-32-0x00000195ED550000-0x00000195ED551000-memory.dmp
memory/1044-33-0x00000195ED570000-0x00000195ED571000-memory.dmp
memory/1044-34-0x00000195ED570000-0x00000195ED571000-memory.dmp
memory/1044-35-0x00000195ED570000-0x00000195ED571000-memory.dmp
memory/1044-36-0x00000195ED570000-0x00000195ED571000-memory.dmp
memory/1044-37-0x00000195ED570000-0x00000195ED571000-memory.dmp
memory/1044-38-0x00000195ED570000-0x00000195ED571000-memory.dmp
memory/1044-39-0x00000195ED570000-0x00000195ED571000-memory.dmp
memory/1044-40-0x00000195ED570000-0x00000195ED571000-memory.dmp
memory/1044-41-0x00000195ED570000-0x00000195ED571000-memory.dmp
memory/1044-42-0x00000195ED570000-0x00000195ED571000-memory.dmp
memory/1044-43-0x00000195ED1A0000-0x00000195ED1A1000-memory.dmp
memory/1044-44-0x00000195ED190000-0x00000195ED191000-memory.dmp
memory/1044-46-0x00000195ED1A0000-0x00000195ED1A1000-memory.dmp
memory/1044-49-0x00000195ED190000-0x00000195ED191000-memory.dmp
memory/1044-52-0x00000195ED0D0000-0x00000195ED0D1000-memory.dmp
memory/1044-64-0x00000195ED2D0000-0x00000195ED2D1000-memory.dmp
memory/1044-66-0x00000195ED2E0000-0x00000195ED2E1000-memory.dmp
memory/1044-67-0x00000195ED2E0000-0x00000195ED2E1000-memory.dmp
memory/1044-68-0x00000195ED3F0000-0x00000195ED3F1000-memory.dmp