82e754c49b1fe594fefb037bd047b8b86df79c86811089c7e527c18c92ccc3f6

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/10/2024, 15:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

82e754c49b1fe594fefb037bd047b8b86df79c86811089c7e527c18c92ccc3f6.exe
Size

1.1MB
MD5

135d4e44291ea604489a0b940c2740b7
SHA1

6f83c2992863b6e9ec31f3246b7c237d8f7cfba9
SHA256

82e754c49b1fe594fefb037bd047b8b86df79c86811089c7e527c18c92ccc3f6
SHA512

4770734d545a2ae2f0ed4e1a31e37b8b663fe1854ef7009269c7049f60013e76865b37bd6f4bf6d23e0f7225c4b6cce8ffb4f3b5ed38e83f03fd37e127e68924
SSDEEP

24576:YCAnKGF3FKxeW65LfNl6TkGSkQ/7Gb8NLEbeZ:jAnKsEgLfNfkQ/qoLEw

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	82e754c49b1fe594fefb037bd047b8b86df79c86811089c7e527c18c92ccc3f6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2644	82e754c49b1fe594fefb037bd047b8b86df79c86811089c7e527c18c92ccc3f6.exe

C:\Users\Admin\AppData\Local\Temp\82e754c49b1fe594fefb037bd047b8b86df79c86811089c7e527c18c92ccc3f6.exe
"C:\Users\Admin\AppData\Local\Temp\82e754c49b1fe594fefb037bd047b8b86df79c86811089c7e527c18c92ccc3f6.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2644-0-0x0000000140000000-0x000000014013F000-memory.dmp

Filesize
1.2MB

Download
memory/2644-1-0x0000000000310000-0x0000000000370000-memory.dmp

Filesize
384KB

Download
memory/2644-9-0x0000000000310000-0x0000000000370000-memory.dmp

Filesize
384KB

Download
memory/2644-14-0x0000000140000000-0x000000014013F000-memory.dmp

Filesize
1.2MB

Download
memory/2644-15-0x0000000000310000-0x0000000000370000-memory.dmp

Filesize
384KB

Download