Analysis

  • max time kernel
    93s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/07/2024, 06:05

General

  • Target

    17827413469070261be185334a4703d13b91c0b1d76f27ab757e0acf2cbbd0eb.exe

  • Size

    1.6MB

  • MD5

    bd197c5d5c88f90a924f08551e83003f

  • SHA1

    c109bbbba149bb7490f187d08e6d7dbd6b689735

  • SHA256

    17827413469070261be185334a4703d13b91c0b1d76f27ab757e0acf2cbbd0eb

  • SHA512

    ea3ad1dd7ceaf3fc16f02636628fee957b1c256be37ec1d2d37723f8ff5e3c3ebd8837c38c552fbe9609ba0c2d767f9f110a96e727cbead81b02288ae7d3ebe2

  • SSDEEP

    24576:Sh9B3Cks7WE9F5pwg8zmdqQjC60jiHkU:SB3Cks7R9L58UqFJjskU

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\17827413469070261be185334a4703d13b91c0b1d76f27ab757e0acf2cbbd0eb.exe
    "C:\Users\Admin\AppData\Local\Temp\17827413469070261be185334a4703d13b91c0b1d76f27ab757e0acf2cbbd0eb.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    PID:4828

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/4828-0-0x0000000000400000-0x000000000059C000-memory.dmp

          Filesize

          1.6MB

        • memory/4828-1-0x0000000000A20000-0x0000000000A87000-memory.dmp

          Filesize

          412KB

        • memory/4828-8-0x0000000000A20000-0x0000000000A87000-memory.dmp

          Filesize

          412KB

        • memory/4828-12-0x0000000000400000-0x000000000059C000-memory.dmp

          Filesize

          1.6MB