Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
-
submitted
21-08-2024 20:06
General
-
Target
SpectrumInstaller 1.exe
-
Size
10KB
-
MD5
f80e3dbe24eb435b0ccfbe2669631021
-
SHA1
24b5dfddc15636378950081771892f27d4228ce6
-
SHA256
3f224e06cb7e57c1553ed15440da6cd4f261fccad857b1e404c0b0b3cd70ac95
-
SHA512
85b0e7b00d0cd43910436b619fa1dd9569ca485bb0dffcab76960e7d03e1a2e0530309b61641295f59f7b5bd9d6680fc14c21033fe27dd0267a826362fc27faa
-
SSDEEP
192:QIRREv+2q/A/apPBYmRBIAar3bu64AjzExUZ:Qdq4/aJ2m/x6CxU
Score
6/10
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SpectrumInstaller 1.exe"C:\Users\Admin\AppData\Local\Temp\SpectrumInstaller 1.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 19242⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4372 -ip 43721⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
32KB
-
Filesize
40KB
-
Filesize
7.7MB
-
Filesize
7.7MB