Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
23-05-2024 03:27
General
-
Target
d2fd6532d13c83258b0872613833204734ae3ea12ab37e90e046c675fc83e728.exe
-
Size
4.0MB
-
MD5
e0d7a0112018073b98b070a8e9535be9
-
SHA1
08b02c1eba19a1d4478b1d9af1e1d42120656afe
-
SHA256
d2fd6532d13c83258b0872613833204734ae3ea12ab37e90e046c675fc83e728
-
SHA512
ca97ec79675f92e9f5a6e221daf2d23e32cc53f587bf13842f6a6d7b32839c64c2ae020f8a6664fc2a2d09f32b544e6b28349db39c0c7490b433addf47fb3a87
-
SSDEEP
98304:YUq/cc0FeBHC9UOXX4KTNuclLCfPy6Kp5+SPsNQLD0imnCT:g/+oBi1XpTNuRfPsPiG0bnCT
Score
7/10
Malware Config
Signatures
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d2fd6532d13c83258b0872613833204734ae3ea12ab37e90e046c675fc83e728.exe"C:\Users\Admin\AppData\Local\Temp\d2fd6532d13c83258b0872613833204734ae3ea12ab37e90e046c675fc83e728.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4552,i,14486271492189381216,15799931579469722648,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:81⤵