Analysis
-
max time kernel
11s -
max time network
15s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
19-07-2024 11:38
General
-
Target
8de63e923d1292152fd11e87bb98fec0N.exe
-
Size
83KB
-
MD5
8de63e923d1292152fd11e87bb98fec0
-
SHA1
b2f55df18e3d2e2993ba05e04b19c199e293975e
-
SHA256
181a280f84c05f20a72477e9fdbe73f08fb2b38b6cc7d33b86e565103b1439c2
-
SHA512
6f3a3a86848f0ce8ee6e2b743ce79ce3404f7ade1087465329a499a0522e36ef83d65320060bb6d64967ca588ab19dd87ce2a52f45bc16cf0c50cc074d8b74b4
-
SSDEEP
1536:LaWLF1kxTnUI4CFPtv6iSJnaGlbVxhoOSQxzG:LaWExTnUTCFPtvanaGlbVxhoOi
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8de63e923d1292152fd11e87bb98fec0N.exe"C:\Users\Admin\AppData\Local\Temp\8de63e923d1292152fd11e87bb98fec0N.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Winkmsh.exeC:\Windows\SysWOW64\Winkmsh.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
81KB
MD5045fdcc5b3a617d7f750184adff4b2e2
SHA1d5d500fe7501ec79926e9cc1a8b18784da0689d0
SHA256c8232e56c34d6d15e29e2323b4206a669ecfedfffcfaadfef236d294a8729176
SHA512aca76ba70fd088b660e6f7ea2fc1909c1a3518c54ea9b1c2c3b2267fb2628a03b72dcfab7535f6f9f2e88358996fb4c71f414ccc098ed27fb2de14f7e3534b17
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB