Analysis
-
max time kernel
838s -
max time network
840s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
08-06-2024 07:56
General
-
Target
download.exe
-
Size
88KB
-
MD5
94c73dc6cc79de28524a82f04adc7c6b
-
SHA1
8ce1411adede8a1485ad718160ef01c7a22634de
-
SHA256
40596da4af2b1b0387147484d112423d317e2fd41cd19bb1b63d2f8429bacee4
-
SHA512
820b38de02b00668b24e6dc0510f632a7648bd1e647f5a9ee0c7d8bd8b86a49b55db72e1cfa2eff0337dc30d6b1cb45af1f904a9105715618d410ff56841d041
-
SSDEEP
768:+CIFqF93IfXwXbOfq1okh8BBEjpaPWfu/WYat7PTXDvt976xrXu5Me0:+C4qF9pbOAh8B+Bfu+YaZTXTt97KruM
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\download.exe"C:\Users\Admin\AppData\Local\Temp\download.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1652 -s 5122⤵
-
-
C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe"C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
112KB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
32KB
-
Filesize
2.9MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB