Analysis

  • max time kernel
    120s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    28/05/2024, 23:10

General

  • Target

    99e9c94b1c1265ad5d1f89014dc7518586d095a6c3e416f864c4ac34744b273d.exe

  • Size

    13.6MB

  • MD5

    6de1c1093b8d84dcd764328cdb296114

  • SHA1

    4bfa3fb15e8b5c816f28bda0f23ee1dda9f73cf4

  • SHA256

    99e9c94b1c1265ad5d1f89014dc7518586d095a6c3e416f864c4ac34744b273d

  • SHA512

    70f45a68c24ab427682e02831f02136cbb6df24b830e9600241ccafb93133e2893c9ad87503a88082a9cf083984f777c79874f11da12671da7861a4d816665a1

  • SSDEEP

    393216:jhhIvSmMjRO5sb2EGZBAe890kRKHh1AoSFaUQkcS2:jsvwjw2b2E6hROKBKo/kc5

Score
1/10

Malware Config

Signatures

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\99e9c94b1c1265ad5d1f89014dc7518586d095a6c3e416f864c4ac34744b273d.exe
    "C:\Users\Admin\AppData\Local\Temp\99e9c94b1c1265ad5d1f89014dc7518586d095a6c3e416f864c4ac34744b273d.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2208

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2208-1-0x0000000000400000-0x0000000002079000-memory.dmp

    Filesize

    28.5MB

  • memory/2208-13-0x0000000000410000-0x0000000000411000-memory.dmp

    Filesize

    4KB

  • memory/2208-12-0x00000000776FC000-0x00000000776FD000-memory.dmp

    Filesize

    4KB

  • memory/2208-11-0x00000000776E3000-0x00000000776E4000-memory.dmp

    Filesize

    4KB

  • memory/2208-10-0x0000000002180000-0x00000000021AB000-memory.dmp

    Filesize

    172KB

  • memory/2208-9-0x00000000776F1000-0x00000000776F2000-memory.dmp

    Filesize

    4KB

  • memory/2208-8-0x00000000776DD000-0x00000000776DE000-memory.dmp

    Filesize

    4KB

  • memory/2208-7-0x00000000776DE000-0x00000000776DF000-memory.dmp

    Filesize

    4KB

  • memory/2208-5-0x0000000002180000-0x00000000021AB000-memory.dmp

    Filesize

    172KB

  • memory/2208-4-0x0000000010000000-0x0000000010059000-memory.dmp

    Filesize

    356KB

  • memory/2208-14-0x0000000000400000-0x0000000002079000-memory.dmp

    Filesize

    28.5MB

  • memory/2208-15-0x0000000000400000-0x0000000002079000-memory.dmp

    Filesize

    28.5MB

  • memory/2208-16-0x0000000000400000-0x0000000002079000-memory.dmp

    Filesize

    28.5MB

  • memory/2208-18-0x0000000010000000-0x0000000010059000-memory.dmp

    Filesize

    356KB

  • memory/2208-19-0x0000000002180000-0x00000000021AB000-memory.dmp

    Filesize

    172KB