Overview

overview

6

Static

static

3

ed2b03946a...63.exe

windows7-x64

1

ed2b03946a...63.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/05/2024, 06:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    ed2b03946abe8ffcb842a2ee44146c4df06007ff93cf4e0e00f17eaf82f9d063.exe

  • Size

    605KB

  • MD5

    177c6e94a1ad1e52a69b2370772897ef

  • SHA1

    1b89350929f507a5fede29391d223a617bed8c6b

  • SHA256

    ed2b03946abe8ffcb842a2ee44146c4df06007ff93cf4e0e00f17eaf82f9d063

  • SHA512

    5cb3e6dbf7d4be896af6c7f86e9f191c5f385d71b1bcfb9ebffa93e7ad8af1ca8e0c39290463ff1cada9b4245d9895ab9c7e853903fd419b764aeb3a6a69920e

  • SSDEEP

    12288:HF3L+fySOgIFfOUyb8WaLMJEEfSh25z0oCD5:cxAODlaMfSh25QLD5

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ed2b03946abe8ffcb842a2ee44146c4df06007ff93cf4e0e00f17eaf82f9d063.exe
    "C:\Users\Admin\AppData\Local\Temp\ed2b03946abe8ffcb842a2ee44146c4df06007ff93cf4e0e00f17eaf82f9d063.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3508

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/3508-0-0x000000007531E000-0x000000007531F000-memory.dmp

          Filesize

          4KB

          Download

        • memory/3508-1-0x0000000000520000-0x00000000005BC000-memory.dmp

          Filesize

          624KB

          Download

        • memory/3508-2-0x0000000005610000-0x0000000005BB4000-memory.dmp

          Filesize

          5.6MB

          Download

        • memory/3508-3-0x0000000004FA0000-0x0000000005032000-memory.dmp

          Filesize

          584KB

          Download

        • memory/3508-4-0x0000000075310000-0x0000000075AC0000-memory.dmp

          Filesize

          7.7MB

          Download

        • memory/3508-5-0x00000000051A0000-0x00000000051AA000-memory.dmp

          Filesize

          40KB

          Download

        • memory/3508-6-0x0000000075310000-0x0000000075AC0000-memory.dmp

          Filesize

          7.7MB

          Download

        • memory/3508-7-0x0000000075310000-0x0000000075AC0000-memory.dmp

          Filesize

          7.7MB

          Download

        • memory/3508-8-0x0000000075310000-0x0000000075AC0000-memory.dmp

          Filesize

          7.7MB

          Download

        • memory/3508-9-0x0000000075310000-0x0000000075AC0000-memory.dmp

          Filesize

          7.7MB

          Download

        • memory/3508-10-0x000000000AE70000-0x000000000B1C4000-memory.dmp

          Filesize

          3.3MB

          Download

        • memory/3508-11-0x000000000A960000-0x000000000A982000-memory.dmp

          Filesize

          136KB

          Download

        • memory/3508-12-0x000000000A9C0000-0x000000000A9D2000-memory.dmp

          Filesize

          72KB

          Download

        • memory/3508-13-0x000000000AA20000-0x000000000AA5C000-memory.dmp

          Filesize

          240KB

          Download

        • memory/3508-16-0x0000000075310000-0x0000000075AC0000-memory.dmp

          Filesize

          7.7MB

          Download

        • memory/3508-17-0x000000007531E000-0x000000007531F000-memory.dmp

          Filesize

          4KB

          Download

        • memory/3508-18-0x0000000075310000-0x0000000075AC0000-memory.dmp

          Filesize

          7.7MB

          Download

        • memory/3508-19-0x0000000075310000-0x0000000075AC0000-memory.dmp

          Filesize

          7.7MB

          Download

        • memory/3508-20-0x0000000075310000-0x0000000075AC0000-memory.dmp

          Filesize

          7.7MB

          Download

        • memory/3508-21-0x0000000075310000-0x0000000075AC0000-memory.dmp

          Filesize

          7.7MB

          Download

        • memory/3508-22-0x0000000075310000-0x0000000075AC0000-memory.dmp

          Filesize

          7.7MB

          Download

        • memory/3508-23-0x0000000075310000-0x0000000075AC0000-memory.dmp

          Filesize

          7.7MB

          Download