Analysis
-
max time kernel
95s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19-09-2024 07:12
General
-
Target
Bypass/Bypass.exe
-
Size
4.9MB
-
MD5
b00d8023968399d471e6afcf04da5b99
-
SHA1
faa12eea844f2cf08436e64ca0e055ac92858f68
-
SHA256
af6e61e36ffc7794e537a8cedc43d0defc6b742548d57c9a263af0d6b8e2c9a6
-
SHA512
e940cb4d59c2db17177d4c258ec9465fe4e2fa00e0d5a87b82abfdb4be41b6fd384f17df35cc3514515b49c34759d5614b62fbef84c77ed4eb218eb4faad1a96
-
SSDEEP
98304:kFgBNn68MRE4fXlJoXTgxExhG6QnVGCSwZ3iLionTlb3:kFuU1vYciTdwRXoTd
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bypass\Bypass.exe"C:\Users\Admin\AppData\Local\Temp\Bypass\Bypass.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD5a56d036f25b61fdb5654d7e0431f5bc7
SHA16641d46e70da8699d3f86ad23f175ff25f3f7a91
SHA25694ab7ce360036d01b24b5dbc84f31ad2c256486584008eb8f96c79a266683efc
SHA512f7781fdae91f28e675288c1569b9020457c8582081ce2b5fdf318ecefa336b7ea2a93506355605cbeb54b7627e615a46f1b5e96b592e7ef389aaddcc231194b6
-
Filesize
7.7MB
-
Filesize
4.9MB
-
Filesize
548KB
-
Filesize
136KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
696KB
-
Filesize
7.7MB