Analysis

  • max time kernel
    120s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    03-10-2024 06:54

General

  • Target

    ee5e15f0a5d97e1c50e1b74e2856852979d7018e559635d2dd2bf93504cd0817.exe

  • Size

    24.4MB

  • MD5

    a2409ced4e462f3a09540fc3f9bc2c72

  • SHA1

    9b87fc0e83dfb069170cb8e4fda8e5dac36fa458

  • SHA256

    ee5e15f0a5d97e1c50e1b74e2856852979d7018e559635d2dd2bf93504cd0817

  • SHA512

    07f4a9bc4b5cb4d72dc9dddd8965a94556d3c97fa6bd9a2f1cf2bddc54b83768acdc8ebcdca1ee774702c5cb80cc2e2d898c98764a16697b898488a5bbb5c498

  • SSDEEP

    393216:0T0WwBrLtviphyCNYsB0a6/PRGTUJO/klUROsvsZdZJMZ:0Iviphy0yD/PkTUmw4vwdfMZ

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ee5e15f0a5d97e1c50e1b74e2856852979d7018e559635d2dd2bf93504cd0817.exe
    "C:\Users\Admin\AppData\Local\Temp\ee5e15f0a5d97e1c50e1b74e2856852979d7018e559635d2dd2bf93504cd0817.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2128-6-0x0000000140000000-0x000000014285D000-memory.dmp

    Filesize

    40.4MB

  • memory/2128-5-0x00000001401BE000-0x0000000140FDC000-memory.dmp

    Filesize

    14.1MB

  • memory/2128-4-0x0000000077C90000-0x0000000077C92000-memory.dmp

    Filesize

    8KB

  • memory/2128-2-0x0000000077C90000-0x0000000077C92000-memory.dmp

    Filesize

    8KB

  • memory/2128-0-0x0000000077C90000-0x0000000077C92000-memory.dmp

    Filesize

    8KB

  • memory/2128-11-0x0000000140000000-0x000000014285D000-memory.dmp

    Filesize

    40.4MB

  • memory/2128-12-0x0000000140000000-0x000000014285D000-memory.dmp

    Filesize

    40.4MB

  • memory/2128-13-0x00000001401BE000-0x0000000140FDC000-memory.dmp

    Filesize

    14.1MB