Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    30-11-2024 14:12

General

  • Target

    M Centers.exe

  • Size

    1.6MB

  • MD5

    1d3d75fa1c81b55d68500d95a92807fb

  • SHA1

    c45be1e05788005a24e4c73628d1f85003890957

  • SHA256

    5f405489a7f6c67bbcc130ebbb272a99bde94b0d01b1b958f6f05580fb58a2d3

  • SHA512

    b910ed4d71503d888d004b28b4991f8d5b8635ad0fb708cc987f4996a1f4e6ee22469f0c9c29946913988fea3163c5f6e313fdf643249eba4adf9d5df0cfcc83

  • SSDEEP

    49152:Lj2I6gR13Be4vZ+5o12w1cRTTQAwnnsn3nmB:nPRNXBGhw1wTEAwnnsn3nmB

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\M Centers.exe
    "C:\Users\Admin\AppData\Local\Temp\M Centers.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3656

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3656-0-0x00007FFEE8773000-0x00007FFEE8775000-memory.dmp

    Filesize

    8KB

  • memory/3656-1-0x00000241BBCA0000-0x00000241BBE44000-memory.dmp

    Filesize

    1.6MB

  • memory/3656-2-0x00000241BDC10000-0x00000241BDC4E000-memory.dmp

    Filesize

    248KB

  • memory/3656-3-0x00007FFEE8770000-0x00007FFEE9232000-memory.dmp

    Filesize

    10.8MB

  • memory/3656-4-0x00007FFEE8770000-0x00007FFEE9232000-memory.dmp

    Filesize

    10.8MB

  • memory/3656-5-0x00000241D6FF0000-0x00000241D7964000-memory.dmp

    Filesize

    9.5MB

  • memory/3656-6-0x00000241BDDE0000-0x00000241BDE34000-memory.dmp

    Filesize

    336KB

  • memory/3656-7-0x00000241D6830000-0x00000241D68EA000-memory.dmp

    Filesize

    744KB

  • memory/3656-8-0x00007FFEE8770000-0x00007FFEE9232000-memory.dmp

    Filesize

    10.8MB

  • memory/3656-9-0x00000241D6FE0000-0x00000241D6FE8000-memory.dmp

    Filesize

    32KB

  • memory/3656-11-0x00000241D9EE0000-0x00000241D9EEE000-memory.dmp

    Filesize

    56KB

  • memory/3656-10-0x00000241D9F10000-0x00000241D9F48000-memory.dmp

    Filesize

    224KB

  • memory/3656-12-0x00007FFEE8770000-0x00007FFEE9232000-memory.dmp

    Filesize

    10.8MB

  • memory/3656-13-0x00007FFEE8773000-0x00007FFEE8775000-memory.dmp

    Filesize

    8KB

  • memory/3656-14-0x00007FFEE8770000-0x00007FFEE9232000-memory.dmp

    Filesize

    10.8MB