Analysis
-
max time kernel
92s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17-11-2024 17:33
General
-
Target
tmpfile-main/0000000r00d000r3.exe
-
Size
4.9MB
-
MD5
340753116751ef6f5212667501a0e562
-
SHA1
ad4d25b43964c1c54accdcbe97a3f2ca80d15894
-
SHA256
b61907b9081bb5d7125264c5e60de013c02b7b866148248de603fb55f8d39a18
-
SHA512
d9564e38ea4000c16ebacc4a4b95925c8998d2bce33b3ad7bd0aa0b220d60f372d798591f4365b1271085036055519e4a94afd47d51ad5a2c6002e1f54ffc2f2
-
SSDEEP
98304:w4KoSKQ6Kob7IdoOPn49MWTB9z2OuVIsFx6fZPELW4sF+JKcNWdZRM9b7:wAXQFob7Idj/4VTbaVIsSBfFoxMnsb
Score
8/10
Malware Config
Signatures
-
Sets service image path in registry 2 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmpfile-main\0000000r00d000r3.exe"C:\Users\Admin\AppData\Local\Temp\tmpfile-main\0000000r00d000r3.exe"1⤵
- Sets service image path in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
-
Filesize
8KB
-
Filesize
8.6MB
-
Filesize
2.5MB