c9c660914e4d58a6e0dd460afae6e4af288c9f191ad8592dc95db5a69868fc70

max time kernel
91s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
13-05-2024 07:44

Sharing

Target

Loader.exe
Size

347KB
MD5

1cb742cb95699d994e1cc6810c6f7642
SHA1

103ea603322859742a3e51c5e517a927b9dcd40c
SHA256

c9c660914e4d58a6e0dd460afae6e4af288c9f191ad8592dc95db5a69868fc70
SHA512

79f9a70232b3470ef9386d9b3d987b5370d0562959315d8239509000a1aa9274b13cecc4c6c871cd4d258a0cd19d30574e3280edd54fb108b6ffca7d8c7e4795
SSDEEP

6144:RrwFDD0tZzmf7GxMLEYaEzE2d9JK5/J1pZKM35QM6KkfiruhbOuzB:Rg07e7seE2dK71rKu5Q6kfirIbOuF

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Loader.exe

description	pid	Process
Token: SeDebugPrivilege	1088	Loader.exe

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1088

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Roaming\Checker.exe

Filesize
760B

MD5
122bd2fa7af08246dddadd14149aede0

SHA1
56fc7af55346efdc2ddcf8205028a9c006f4c321

SHA256
6c6d40b3ff7496115922be6b767acf9160e856235965918d3d153c83e076e493

SHA512
00cb38aa566f9dbe66284bc4603256ff1336a5392f80921b69f9a64da5de8aee48e86f556bec30748b5263c8d2d68ade30dfce2917676e2b3240b119326ed30c

Download Submit
memory/1088-0-0x0000000000470000-0x00000000004CE000-memory.dmp

Filesize
376KB

Download
memory/1088-1-0x00007FFDF5E13000-0x00007FFDF5E15000-memory.dmp

Filesize
8KB

Download
memory/1088-2-0x00007FFDF5E10000-0x00007FFDF68D2000-memory.dmp

Filesize
10.8MB

Download
memory/1088-13-0x00007FFDF5E10000-0x00007FFDF68D2000-memory.dmp

Filesize
10.8MB

Download