774bc51c7a1c63d3452ad7183db50034131d1c8deb0244ef7356bd7300a34ca6

Analysis

max time kernel
838s
max time network
839s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 18:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a67df0a8b32bdc5f9d224db118b3153f66518737e702314873b673c914b2bb5c.exe
Size

986KB
MD5

338476c2b0de4ee2f3e402f3495d0578
SHA1

03916123864aa034f7ca3b9d45b2e39b5c91c502
SHA256

a67df0a8b32bdc5f9d224db118b3153f66518737e702314873b673c914b2bb5c
SHA512

a59ff58d5125b8f70433bd54eb4ac3f3cb32a8ec8dfbfbe3480ebdfd644e2299f32a6ff9f41a08b3ee3d00ac02549e5bcd249b5675ef9cf00d40ff0fbe5aae66
SSDEEP

24576:gs2BSX1MZFkT3qF8cpLmvJpWG3FYSxUlmrXqWKBs64:LGSae8ypB0YjKBe

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\MicrosoftEdgeUpdateTaskMachineCore{1575CC8A-457A-1700-652A-6AF2B031A266}.job	a67df0a8b32bdc5f9d224db118b3153f66518737e702314873b673c914b2bb5c.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1420	a67df0a8b32bdc5f9d224db118b3153f66518737e702314873b673c914b2bb5c.exe
1420	a67df0a8b32bdc5f9d224db118b3153f66518737e702314873b673c914b2bb5c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1420	a67df0a8b32bdc5f9d224db118b3153f66518737e702314873b673c914b2bb5c.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a67df0a8b32bdc5f9d224db118b3153f66518737e702314873b673c914b2bb5c.exe
"C:\Users\Admin\AppData\Local\Temp\a67df0a8b32bdc5f9d224db118b3153f66518737e702314873b673c914b2bb5c.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads