Overview

overview

6

Static

static

3

fef821888f...77.exe

windows7-x64

6

fef821888f...77.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    142s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/05/2024, 02:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    fef821888f6404c0dc9bb11a6379ddfd8914788c160e120b240d0f9895721a77.exe

  • Size

    526KB

  • MD5

    66d48b3826e3016e6d94eaa1a91e8d99

  • SHA1

    f308814073e331defb730de324d9792044eff504

  • SHA256

    fef821888f6404c0dc9bb11a6379ddfd8914788c160e120b240d0f9895721a77

  • SHA512

    abe7054742b2621ce301b4eb0e579dcbbb8b59dcade673ecea6fb2ee4b7cf24383b37cf69607ec8923566e8e01636571106acaf7ee5bc43db0ed30bf8288aaad

  • SSDEEP

    192:xPuTunAtt5Pg1lld07xFVd4yywe/2D4Ec7KdT:tYcAP+PlOzVdNpe/REmi

Score
6/10

Malware Config

Signatures

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fef821888f6404c0dc9bb11a6379ddfd8914788c160e120b240d0f9895721a77.exe
    "C:\Users\Admin\AppData\Local\Temp\fef821888f6404c0dc9bb11a6379ddfd8914788c160e120b240d0f9895721a77.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2964
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1348 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:4184

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/2964-0-0x00000000747CE000-0x00000000747CF000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2964-1-0x00000000008D0000-0x00000000008DA000-memory.dmp

            Filesize

            40KB

            Download

          • memory/2964-2-0x0000000005250000-0x00000000052E2000-memory.dmp

            Filesize

            584KB

            Download

          • memory/2964-3-0x00000000747C0000-0x0000000074F70000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/2964-4-0x0000000005B10000-0x00000000060B4000-memory.dmp

            Filesize

            5.6MB

            Download

          • memory/2964-5-0x0000000006230000-0x0000000006296000-memory.dmp

            Filesize

            408KB

            Download

          • memory/2964-6-0x00000000747CE000-0x00000000747CF000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2964-7-0x00000000747C0000-0x0000000074F70000-memory.dmp

            Filesize

            7.7MB

            Download