Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
05/07/2024, 20:53
General
-
Target
400bafb56404b084eacd4654d256f4c02f4c95ef2d712ceda022d19d4f5a54e0.exe
-
Size
771KB
-
MD5
e404aa12a6d106ef79c05f1b25594199
-
SHA1
1882a547b2ca605e9eadcfbae4a64fe72c90ed65
-
SHA256
400bafb56404b084eacd4654d256f4c02f4c95ef2d712ceda022d19d4f5a54e0
-
SHA512
770810d48f7a6efd9254dd58765949cf4d72d3c8d7a1674bf42febf032ebe1739c0ed1432e06e40aaf5d7b4d8a748633c318a34df332dc519b5789b3f18b3471
-
SSDEEP
12288:h2Y+FUB2UBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3G:hn+qB2t2rR8FfBhRJUEbDk1ulUW
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 4 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\400bafb56404b084eacd4654d256f4c02f4c95ef2d712ceda022d19d4f5a54e0.exe"C:\Users\Admin\AppData\Local\Temp\400bafb56404b084eacd4654d256f4c02f4c95ef2d712ceda022d19d4f5a54e0.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
661KB
MD5304b5c6f70148ceae78a4ff5f6317c29
SHA13accf4d32816d4aec29f2979a74d5d3168c2fffc
SHA2563400eebc54cae38361bb26030335172c8edae99d1998d7835c0ab8dd8c9f4f09
SHA512177afbb63595240a8dc93ce6617af1dfb3f68b15c56cc1fcc7aeb102366a37a817010f12bf0c51ec582702e71c57c8f198d9a9f1dd532b77ed17a7b86782607b
-
Filesize
788KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
788KB
-
Filesize
680KB
-
Filesize
680KB