Analysis

  • max time kernel
    120s
  • max time network
    116s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240709-en
  • resource tags

    arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    14-07-2024 08:00

General

  • Target

    Panel/Panel.exe

  • Size

    1.7MB

  • MD5

    29c3965e2f5893bd7905ca589cae3188

  • SHA1

    1276122036cfd994e323621dfe9d3b3e588d149d

  • SHA256

    c49b8186447154807bad77030cfbde76fd9a6053616537e4c31ed78fbcf2d7d6

  • SHA512

    268d894ceabf6366d2197b4a2f9c83b05a7afe322508eab08bdd737fa13caf0daaea537075cc4709aade634847f24135cfd290a172bce9259dd8fee6b2d6afa3

  • SSDEEP

    12288:jLxeIKOsGPgbym1AYdjXpXpXpXpXpXpXEX0XjlC07Ms4HRdt4umBNOu/XpXpXpXw:jLRKOJlYd5B7MsW2ijf96EB2VgmvvWR

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Panel\Panel.exe
    "C:\Users\Admin\AppData\Local\Temp\Panel\Panel.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2236
    • C:\Users\Admin\AppData\Local\Temp\Panel\Panel.exe
      "C:\Users\Admin\AppData\Local\Temp\Panel\Panel.exe" "--monitor"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1840

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1840-10-0x00007FFD0E860000-0x00007FFD0F322000-memory.dmp

    Filesize

    10.8MB

  • memory/1840-19-0x0000021243B30000-0x0000021243B6C000-memory.dmp

    Filesize

    240KB

  • memory/1840-11-0x00007FFD0E860000-0x00007FFD0F322000-memory.dmp

    Filesize

    10.8MB

  • memory/1840-3-0x00007FFD0E860000-0x00007FFD0F322000-memory.dmp

    Filesize

    10.8MB

  • memory/1840-4-0x0000021227420000-0x000002122745A000-memory.dmp

    Filesize

    232KB

  • memory/1840-5-0x000002123FE70000-0x000002123FF20000-memory.dmp

    Filesize

    704KB

  • memory/1840-6-0x000002123FB40000-0x000002123FB62000-memory.dmp

    Filesize

    136KB

  • memory/1840-7-0x00007FFD0E860000-0x00007FFD0F322000-memory.dmp

    Filesize

    10.8MB

  • memory/1840-12-0x0000021243A60000-0x0000021243AAA000-memory.dmp

    Filesize

    296KB

  • memory/1840-9-0x00000212400C0000-0x0000021240134000-memory.dmp

    Filesize

    464KB

  • memory/1840-27-0x00007FFD0E860000-0x00007FFD0F322000-memory.dmp

    Filesize

    10.8MB

  • memory/1840-26-0x00007FFD0E860000-0x00007FFD0F322000-memory.dmp

    Filesize

    10.8MB

  • memory/1840-8-0x0000021225B20000-0x0000021225B32000-memory.dmp

    Filesize

    72KB

  • memory/1840-13-0x0000021243A30000-0x0000021243A48000-memory.dmp

    Filesize

    96KB

  • memory/1840-14-0x000002123FFB0000-0x000002123FFC0000-memory.dmp

    Filesize

    64KB

  • memory/1840-18-0x0000021243AD0000-0x0000021243AE2000-memory.dmp

    Filesize

    72KB

  • memory/1840-25-0x00007FFD0E860000-0x00007FFD0F322000-memory.dmp

    Filesize

    10.8MB

  • memory/1840-21-0x0000021243AC0000-0x0000021243AD0000-memory.dmp

    Filesize

    64KB

  • memory/2236-24-0x00007FFD0E860000-0x00007FFD0F322000-memory.dmp

    Filesize

    10.8MB

  • memory/2236-1-0x0000015F66500000-0x0000015F666B0000-memory.dmp

    Filesize

    1.7MB

  • memory/2236-2-0x00007FFD0E860000-0x00007FFD0F322000-memory.dmp

    Filesize

    10.8MB

  • memory/2236-0-0x00007FFD0E863000-0x00007FFD0E865000-memory.dmp

    Filesize

    8KB