Analysis
-
max time kernel
59s -
max time network
42s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
14/05/2024, 10:41
Static task
static1
Behavioral task
behavioral1
Sample
MSERT.exe
Resource
win10v2004-20240426-en
General
-
Target
MSERT.exe
-
Size
152.4MB
-
MD5
932325ba04cd304770cc71c4d18f6f6a
-
SHA1
ae73d849791ff308036df9fedae48d0807859668
-
SHA256
cd80c6b2c804b0d4547064a827a9ad264c9a69a7c5cb9e5b48c5a52a95fee49e
-
SHA512
cbfaa67cdddb8edfc84136cba98ba06ccf465d39391c9e14e36931bb667f28a910cefdd36904527bd9da2856a258459f7d7a5488f643203591314b59da7f5695
-
SSDEEP
3145728:AbRwGkzOIOAejp8s2bN/XL3wgJzbf4vLsetCaiosQNXliZauaZmOoea5:+kzejplw/7XJHTetdsSXlZ8H
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\msert.log MSERT.exe -
Loads dropped DLL 2 IoCs
pid Process 1352 MSERT.exe 1352 MSERT.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1352 MSERT.exe 1352 MSERT.exe 1352 MSERT.exe 1352 MSERT.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1352 MSERT.exe Token: SeBackupPrivilege 1352 MSERT.exe Token: SeRestorePrivilege 1352 MSERT.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
18.7MB
MD57c4a3e86d06bb14c242fd527e3a78807
SHA1e76ec1fe0dbd08f30ae3b2503cd18ca9c4621e2e
SHA2561a336c3e32661031d380b75c4ead82ed123b97297d26f18408c94e7989391144
SHA512b201ca3441a81812892c26640911c84cb86034b89757d660d98711564d20c34824250e9392f5bace1ed40ecee5c32012bf88d53405f87cc8efb2ee0c330aa58d
-
Filesize
607KB
MD5a0c4ac6378ce0313955dccfd2d9208a6
SHA17ee2f0f3bf4504f4f7bbc63cb5fa883711c13801
SHA256abbe3285c58c830314f9f0ad2ddc769139c0d808e27893290adc69a535b996b1
SHA51272ea9f0d7399fa5d6865f3f887ffa07098b883b1428b33dcb552a40bb22ca6a461a546736667ca1aa97e5f06dffd10dab765c7f6e3e827dd0335b562b27d2fb5