Analysis
- max time kernel
40s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
05/05/2024, 02:09
General
- Target 960329d033489ecf9fb4a1ec565bb55cb83e9a42be5c6debb6d53ec8db154c54.exe
- Size 433KB
- Sample240505-ck95rsbd4s
- SHA256 960329d033489ecf9fb4a1ec565bb55cb83e9a42be5c6debb6d53ec8db154c54
Malware Config
Signatures
- Modifies system certificate store 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 29 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\960329d033489ecf9fb4a1ec565bb55cb83e9a42be5c6debb6d53ec8db154c54.exe"C:\Users\Admin\AppData\Local\Temp\960329d033489ecf9fb4a1ec565bb55cb83e9a42be5c6debb6d53ec8db154c54.exe"1⤵
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2780-0-0x000001C7CE200000-0x000001C7CE26E000-memory.dmp
memory/2780-1-0x00007FFAE0253000-0x00007FFAE0255000-memory.dmp
memory/2780-2-0x00007FFAE0250000-0x00007FFAE0D11000-memory.dmp
memory/2780-16-0x00007FFAE0250000-0x00007FFAE0D11000-memory.dmp
memory/2780-17-0x000001C7D0030000-0x000001C7D0038000-memory.dmp
memory/2780-18-0x00007FFAE0250000-0x00007FFAE0D11000-memory.dmp
memory/2780-19-0x00007FFAE0250000-0x00007FFAE0D11000-memory.dmp
memory/2780-21-0x000001C7EBED0000-0x000001C7EBEDE000-memory.dmp
memory/2780-20-0x000001C7EBF10000-0x000001C7EBF48000-memory.dmp
memory/2780-22-0x00007FFAE0250000-0x00007FFAE0D11000-memory.dmp
memory/2780-23-0x00007FFAE0253000-0x00007FFAE0255000-memory.dmp
memory/2780-24-0x00007FFAE0250000-0x00007FFAE0D11000-memory.dmp
memory/2780-25-0x00007FFAE0250000-0x00007FFAE0D11000-memory.dmp
memory/2780-26-0x00007FFAE0250000-0x00007FFAE0D11000-memory.dmp
memory/2780-28-0x00007FFAE0250000-0x00007FFAE0D11000-memory.dmp
memory/2780-27-0x00007FFAE0250000-0x00007FFAE0D11000-memory.dmp