84bebbe2cc14519a656dd6ee54e892191872f7122ebf53ef6b2349a5218c11e1

Resubmissions

18-07-2024 07:25

240718-h84wjs1hpb 10

18-07-2024 07:19

240718-h51pqa1gng 10

17-07-2024 20:55

240717-zqkhmaydmq 10

17-07-2024 19:21

240717-x2pwdaycjb 10

Analysis

max time kernel
1800s
max time network
1802s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
17-07-2024 19:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

72716d15ea7d118b8c99dbcb15114188abe468718c876ac52b0779161ef7e821.exe
Size

703KB
MD5

d7c62a22cc1a832ba2ce0bfd1c4f9e9c
SHA1

a484b5a49a5b94f045100dd5e659b9504ed99211
SHA256

72716d15ea7d118b8c99dbcb15114188abe468718c876ac52b0779161ef7e821
SHA512

7c036f46c6c5a34d991d277c3ecf3c8abdf3a70042c40aaa3c20ce2f3e02a5a63200530587c2980ba5e000a7f1394a33390e63ec53782892b27874e293dff1c6
SSDEEP

12288:Qu/mk3LQLwumO7mL945Hj1wcBsXcDBif+w+nstV7uikFg:5+WLQLP7mL9eDb+Msfsnstlubg

Score

7^/10

discovery

Malware Config

Signatures

Drops startup file 1 IoCs

Processes:

72716d15ea7d118b8c99dbcb15114188abe468718c876ac52b0779161ef7e821.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Notepad.lnk	72716d15ea7d118b8c99dbcb15114188abe468718c876ac52b0779161ef7e821.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

72716d15ea7d118b8c99dbcb15114188abe468718c876ac52b0779161ef7e821.exe

description	pid	process
Token: SeDebugPrivilege	2720	72716d15ea7d118b8c99dbcb15114188abe468718c876ac52b0779161ef7e821.exe
Token: 33	2720	72716d15ea7d118b8c99dbcb15114188abe468718c876ac52b0779161ef7e821.exe
Token: SeIncBasePriorityPrivilege	2720	72716d15ea7d118b8c99dbcb15114188abe468718c876ac52b0779161ef7e821.exe

C:\Users\Admin\AppData\Local\Temp\72716d15ea7d118b8c99dbcb15114188abe468718c876ac52b0779161ef7e821.exe
"C:\Users\Admin\AppData\Local\Temp\72716d15ea7d118b8c99dbcb15114188abe468718c876ac52b0779161ef7e821.exe"
1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2720-0-0x000007FEF5DCE000-0x000007FEF5DCF000-memory.dmp

Filesize
4KB

Download
memory/2720-1-0x000007FEF5B10000-0x000007FEF64AD000-memory.dmp

Filesize
9.6MB

Download
memory/2720-2-0x000007FEF5B10000-0x000007FEF64AD000-memory.dmp

Filesize
9.6MB

Download
memory/2720-3-0x000000001B050000-0x000000001B0A2000-memory.dmp

Filesize
328KB

Download
memory/2720-4-0x000007FEF5B10000-0x000007FEF64AD000-memory.dmp

Filesize
9.6MB

Download
memory/2720-9-0x000007FEF5B10000-0x000007FEF64AD000-memory.dmp

Filesize
9.6MB

Download
memory/2720-10-0x000007FEF5B10000-0x000007FEF64AD000-memory.dmp

Filesize
9.6MB

Download
memory/2720-11-0x000007FEF5DCE000-0x000007FEF5DCF000-memory.dmp

Filesize
4KB

Download
memory/2720-12-0x000007FEF5B10000-0x000007FEF64AD000-memory.dmp

Filesize
9.6MB

Download
memory/2720-13-0x000007FEF5B10000-0x000007FEF64AD000-memory.dmp

Filesize
9.6MB

Download
memory/2720-14-0x000007FEF5B10000-0x000007FEF64AD000-memory.dmp

Filesize
9.6MB

Download