Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240709-en -
resource tags
arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system -
submitted
22/07/2024, 03:08
Static task
static1
Behavioral task
behavioral1
Sample
Device/HarddiskVolume3/Windows/CSC/v2.0.6/namespace/macvdfs01a/users01$/501393/Desktop/IT/AppCheckDC.exe
Resource
win11-20240709-en
General
-
Target
Device/HarddiskVolume3/Windows/CSC/v2.0.6/namespace/macvdfs01a/users01$/501393/Desktop/IT/AppCheckDC.exe
-
Size
224KB
-
MD5
313e8d34b074b9219defdd369e63d408
-
SHA1
d10014a9477dbf6a342b3f8346a0c3561a69f480
-
SHA256
cf37a75266edce68188a277e9e53b716ef8b2d04767d9eb404265cc8fca3b043
-
SHA512
e7d068ebfe15d6673f41dd1e3c7efa36d568aa0dc3fd05b09c8e452a0d89bfd4400c417cd82cee479b1d84b06afa7c4ff2a2bb31f7b33adc1aac824041c252ee
-
SSDEEP
6144:bKhhJS1IJyE/HBXw/KWf0QZ/oQt92Y2Et4dwY4j:bKhhGIJyE/HhwyK0+//Y4j
Malware Config
Signatures
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini AppCheckDC.exe File opened for modification C:\Windows\assembly\Desktop.ini AppCheckDC.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\assembly AppCheckDC.exe File created C:\Windows\assembly\Desktop.ini AppCheckDC.exe File opened for modification C:\Windows\assembly\Desktop.ini AppCheckDC.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4208 AppCheckDC.exe 4208 AppCheckDC.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4208 AppCheckDC.exe Token: SeDebugPrivilege 4208 AppCheckDC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume3\Windows\CSC\v2.0.6\namespace\macvdfs01a\users01$\501393\Desktop\IT\AppCheckDC.exe"C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume3\Windows\CSC\v2.0.6\namespace\macvdfs01a\users01$\501393\Desktop\IT\AppCheckDC.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4208
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Quest Software\PowerGUI\ecabd43b-d814-449f-9f86-5735fa5a557f\appinfo_new.ps1
Filesize130KB
MD53c06ffb11a06aa5472fcb97b787dc477
SHA15062057e13086874cf7f49c1048c8cf98f63c4a7
SHA2569a2f2a0cf95ed9c46f575232c1b558258e94d1adba337aa3a7b72c7e2c4d24c7
SHA5121bc0ba73dbfaa0a2ed187499190f8a31a9d7c24e265fa22d5b7b720c5b7084745919790d9436fcaea836da1448ba4fb76f0ed21e75dfa248d55ea971b5a61912