Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    13-11-2024 16:44

General

  • Target

    3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe

  • Size

    5.5MB

  • MD5

    8721a0da1f73952ccb9c0656db9adfcd

  • SHA1

    55d68e1f72c1a431b7d2792bacdd59795bda8a90

  • SHA256

    3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb

  • SHA512

    2237debd13d4e9a29899cbd9a6cd07c53f88167334bfb9feaad0705d610cdbc4f6322237745058f914ec46b68c839637b3e305724edc1a628b2b6fbfcd948748

  • SSDEEP

    98304:l9cbdO5jUO9Trz2zObl+6Bn88V/sc/FNVnqyhs8UaBJdxZjUHlzMyZav:l9cUPdHlF9fFhJUaLdxFUHl4Xv

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe
    "C:\Users\Admin\AppData\Local\Temp\3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:752

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/752-0-0x000007FEF5B13000-0x000007FEF5B14000-memory.dmp

    Filesize

    4KB

  • memory/752-1-0x00000000011B0000-0x000000000172E000-memory.dmp

    Filesize

    5.5MB

  • memory/752-2-0x000007FEF5B10000-0x000007FEF64FC000-memory.dmp

    Filesize

    9.9MB

  • memory/752-144-0x000000001CE00000-0x000000001D014000-memory.dmp

    Filesize

    2.1MB

  • memory/752-145-0x000007FEF5B10000-0x000007FEF64FC000-memory.dmp

    Filesize

    9.9MB

  • memory/752-147-0x000007FEF5B13000-0x000007FEF5B14000-memory.dmp

    Filesize

    4KB

  • memory/752-148-0x000007FEF5B10000-0x000007FEF64FC000-memory.dmp

    Filesize

    9.9MB

  • memory/752-149-0x000007FEF5B10000-0x000007FEF64FC000-memory.dmp

    Filesize

    9.9MB