Analysis
- max time kernel
93s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
- submitted
12/06/2024, 04:07
General
- Target $0/RAVAntivirus-installer.exe
- Size 526KB
- Sample240612-epp2ha1ajk
- SHA256 2aecb7a6e46e142344cedbe166bc416cb6167a4023f97f706764336b16d54573
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\$0\RAVAntivirus-installer.exe"C:\Users\Admin\AppData\Local\Temp\$0\RAVAntivirus-installer.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1752-0-0x00007FFE25C33000-0x00007FFE25C35000-memory.dmp
memory/1752-1-0x0000023960910000-0x0000023960992000-memory.dmp
memory/1752-2-0x0000023962660000-0x0000023962690000-memory.dmp
memory/1752-3-0x000002397AD60000-0x000002397AD8E000-memory.dmp
memory/1752-4-0x000002397AE00000-0x000002397AE38000-memory.dmp
memory/1752-5-0x00007FFE25C30000-0x00007FFE266F1000-memory.dmp
memory/1752-6-0x00007FFE25C30000-0x00007FFE266F1000-memory.dmp
memory/1752-7-0x00007FFE25C30000-0x00007FFE266F1000-memory.dmp
memory/1752-8-0x000002397C6A0000-0x000002397C6CE000-memory.dmp
memory/1752-9-0x00007FFE25C30000-0x00007FFE266F1000-memory.dmp
memory/1752-10-0x00007FFE25C30000-0x00007FFE266F1000-memory.dmp
memory/1752-11-0x000002397C740000-0x000002397C748000-memory.dmp
memory/1752-12-0x000002397DFF0000-0x000002397E028000-memory.dmp
memory/1752-13-0x000002397DF80000-0x000002397DF8E000-memory.dmp
memory/1752-14-0x00007FFE25C30000-0x00007FFE266F1000-memory.dmp
memory/1752-15-0x00007FFE25C30000-0x00007FFE266F1000-memory.dmp
memory/1752-16-0x00007FFE25C33000-0x00007FFE25C35000-memory.dmp
memory/1752-17-0x00007FFE25C30000-0x00007FFE266F1000-memory.dmp
memory/1752-18-0x00007FFE25C30000-0x00007FFE266F1000-memory.dmp
memory/1752-19-0x00007FFE25C30000-0x00007FFE266F1000-memory.dmp