Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-12-2024 03:02
General
-
Target
26e9813dd9d80e2b2441d799608214697d7262e24c739bcc11563756c22d3efc.exe
-
Size
27KB
-
MD5
feaca07182c6be327551ba4402a338c7
-
SHA1
5c699eb735def4473b9b02de282ccead84af1061
-
SHA256
26e9813dd9d80e2b2441d799608214697d7262e24c739bcc11563756c22d3efc
-
SHA512
0ada77bc81af9b5d865f06cd6f91457281bdebbf07183367b7d3d0bd598ad7d3ce081b0d1f0741efbbe6c3839620bb17b637ff9727cb3440d5b96b3eab70dda1
-
SSDEEP
384:FLd6XW/7mgEpgHs+k0sePqZhbM2AQk93vmhm7UMKmIEecKdbXTzm9bVhcak63r6s:FQXsqctZ2A/vMHTi9bD
Score
7/10
Malware Config
Signatures
-
Drops startup file 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\26e9813dd9d80e2b2441d799608214697d7262e24c739bcc11563756c22d3efc.exe"C:\Users\Admin\AppData\Local\Temp\26e9813dd9d80e2b2441d799608214697d7262e24c739bcc11563756c22d3efc.exe"1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB