Analysis

  • max time kernel
    150s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-11-2024 16:44

General

  • Target

    3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe

  • Size

    5.5MB

  • MD5

    8721a0da1f73952ccb9c0656db9adfcd

  • SHA1

    55d68e1f72c1a431b7d2792bacdd59795bda8a90

  • SHA256

    3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb

  • SHA512

    2237debd13d4e9a29899cbd9a6cd07c53f88167334bfb9feaad0705d610cdbc4f6322237745058f914ec46b68c839637b3e305724edc1a628b2b6fbfcd948748

  • SSDEEP

    98304:l9cbdO5jUO9Trz2zObl+6Bn88V/sc/FNVnqyhs8UaBJdxZjUHlzMyZav:l9cUPdHlF9fFhJUaLdxFUHl4Xv

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe
    "C:\Users\Admin\AppData\Local\Temp\3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:652
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x2ec 0x3a0
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4696

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/652-0-0x00007FFD4F463000-0x00007FFD4F465000-memory.dmp

    Filesize

    8KB

  • memory/652-1-0x0000000000860000-0x0000000000DDE000-memory.dmp

    Filesize

    5.5MB

  • memory/652-2-0x00007FFD4F460000-0x00007FFD4FF21000-memory.dmp

    Filesize

    10.8MB

  • memory/652-155-0x000000001C880000-0x000000001CA94000-memory.dmp

    Filesize

    2.1MB

  • memory/652-156-0x00007FFD4F460000-0x00007FFD4FF21000-memory.dmp

    Filesize

    10.8MB

  • memory/652-158-0x00007FFD4F463000-0x00007FFD4F465000-memory.dmp

    Filesize

    8KB

  • memory/652-159-0x00007FFD4F460000-0x00007FFD4FF21000-memory.dmp

    Filesize

    10.8MB

  • memory/652-160-0x00007FFD4F460000-0x00007FFD4FF21000-memory.dmp

    Filesize

    10.8MB