Analysis

  • max time kernel
    13s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    10-10-2024 21:32

General

  • Target

    1d47d11dc976beb251c9650e524ddbebcb05cd00fdd1b577b6d714c13fd5370cN.exe

  • Size

    3.2MB

  • MD5

    38d91a4930a59eab50c252452b636380

  • SHA1

    f1933f56f18223c2fcb497c472c513414a04b4d1

  • SHA256

    1d47d11dc976beb251c9650e524ddbebcb05cd00fdd1b577b6d714c13fd5370c

  • SHA512

    d8e28025f42a102a0b1ca6dc7ae4b4b902f1e06043ef7f5a33743a4b8661b68d970a6559d296be66ba1fdc99b3224e3bc4689ee1d60477f9336f79e3546ce09a

  • SSDEEP

    49152:20yAXvucS6SnbZVlxyZH0XAaCx5OX9ZO/xtEfOfzMFvfDTtKjkVE+ubDw8litYOu:tvg6ClrBCjec+OfAK7DuYOQr

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1d47d11dc976beb251c9650e524ddbebcb05cd00fdd1b577b6d714c13fd5370cN.exe
    "C:\Users\Admin\AppData\Local\Temp\1d47d11dc976beb251c9650e524ddbebcb05cd00fdd1b577b6d714c13fd5370cN.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2604
    • C:\Windows\system32\wbem\wmic.exe
      wmic os get oslanguage /FORMAT:LIST
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1248

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads