84bebbe2cc14519a656dd6ee54e892191872f7122ebf53ef6b2349a5218c11e1

Resubmissions

18-07-2024 07:25

240718-h84wjs1hpb 10

18-07-2024 07:19

240718-h51pqa1gng 10

17-07-2024 20:55

240717-zqkhmaydmq 10

17-07-2024 19:21

240717-x2pwdaycjb 10

Analysis

max time kernel
1800s
max time network
1806s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
17-07-2024 19:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9053a3a52113698143a2b9801509c68d0d8b4b8208da453f0974547df0931bc.exe
Size

703KB
MD5

43478841baa4b8754f75516220e33ac3
SHA1

2585a613129d7e3dbff3eb16b10ce3fe940c99a3
SHA256

a9053a3a52113698143a2b9801509c68d0d8b4b8208da453f0974547df0931bc
SHA512

9441209433e2d3d49012431011048cd33a7ce980482658a0b1e2ccd3baa70524d2585901b6130d4644d7ca0139d881a9f11a933949ed39ad805a147694b37f87
SSDEEP

12288:C6JZ+UD5+1fpL2ikTgmPb2EdVu/BdmSHqDd6bhW2RJV7uikFg:JEUD52fpL2bgmSEds/BnKQPlubg

Score

7^/10

discovery

Malware Config

Signatures

Drops startup file 1 IoCs

Processes:

a9053a3a52113698143a2b9801509c68d0d8b4b8208da453f0974547df0931bc.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Notepad.lnk	a9053a3a52113698143a2b9801509c68d0d8b4b8208da453f0974547df0931bc.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

a9053a3a52113698143a2b9801509c68d0d8b4b8208da453f0974547df0931bc.exe

description	pid	process
Token: SeDebugPrivilege	1932	a9053a3a52113698143a2b9801509c68d0d8b4b8208da453f0974547df0931bc.exe
Token: 33	1932	a9053a3a52113698143a2b9801509c68d0d8b4b8208da453f0974547df0931bc.exe
Token: SeIncBasePriorityPrivilege	1932	a9053a3a52113698143a2b9801509c68d0d8b4b8208da453f0974547df0931bc.exe

C:\Users\Admin\AppData\Local\Temp\a9053a3a52113698143a2b9801509c68d0d8b4b8208da453f0974547df0931bc.exe
"C:\Users\Admin\AppData\Local\Temp\a9053a3a52113698143a2b9801509c68d0d8b4b8208da453f0974547df0931bc.exe"
1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
PID:1932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1932-0-0x000007FEF5B7E000-0x000007FEF5B7F000-memory.dmp

Filesize
4KB

Download
memory/1932-1-0x000007FEF58C0000-0x000007FEF625D000-memory.dmp

Filesize
9.6MB

Download
memory/1932-2-0x00000000020B0000-0x0000000002102000-memory.dmp

Filesize
328KB

Download
memory/1932-3-0x000007FEF58C0000-0x000007FEF625D000-memory.dmp

Filesize
9.6MB

Download
memory/1932-4-0x000007FEF58C0000-0x000007FEF625D000-memory.dmp

Filesize
9.6MB

Download
memory/1932-10-0x000007FEF58C0000-0x000007FEF625D000-memory.dmp

Filesize
9.6MB

Download
memory/1932-11-0x000007FEF58C0000-0x000007FEF625D000-memory.dmp

Filesize
9.6MB

Download
memory/1932-12-0x000007FEF58C0000-0x000007FEF625D000-memory.dmp

Filesize
9.6MB

Download
memory/1932-13-0x000007FEF58C0000-0x000007FEF625D000-memory.dmp

Filesize
9.6MB

Download
memory/1932-14-0x000007FEF58C0000-0x000007FEF625D000-memory.dmp

Filesize
9.6MB

Download
memory/1932-15-0x000007FEF58C0000-0x000007FEF625D000-memory.dmp

Filesize
9.6MB

Download
memory/1932-16-0x000007FEF58C0000-0x000007FEF625D000-memory.dmp

Filesize
9.6MB

Download