4a55da3c91388a8ea539fc750b52dd90af5d2f33f2e7269a73c2146243ed24cd

Analysis

max time kernel
143s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-12-2024 08:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da8fee4a89f0b7cee6c8aee970044116.exe
Size

302KB
MD5

da8fee4a89f0b7cee6c8aee970044116
SHA1

226a6fbd66992a0f2ddbf5d7572fab2cf8f5001e
SHA256

4a55da3c91388a8ea539fc750b52dd90af5d2f33f2e7269a73c2146243ed24cd
SHA512

9174bd1c379ed76be342400949a1e431a6430297485fd9c48ed12c60e7de94817b75d645c4ebb17b3a79d66ba813c40c36527f912e927a8ec27e4668d9c09dd8
SSDEEP

6144:CJqAvoYumbeaLVA/HmH6iWmZx/M+VK0lA/OBYJ0tYRVxG2PTY:3AvoYumb9VA/m9WmZxlVK0lAZ/PTY

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Users\\Admin\\AppData\\Roaming\\4590A5356D41623000030\\4590A5356D41623000030.exe"	da8fee4a89f0b7cee6c8aee970044116.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2828	da8fee4a89f0b7cee6c8aee970044116.exe
2828	da8fee4a89f0b7cee6c8aee970044116.exe
2828	da8fee4a89f0b7cee6c8aee970044116.exe
2828	da8fee4a89f0b7cee6c8aee970044116.exe
2828	da8fee4a89f0b7cee6c8aee970044116.exe
2828	da8fee4a89f0b7cee6c8aee970044116.exe
2828	da8fee4a89f0b7cee6c8aee970044116.exe
2828	da8fee4a89f0b7cee6c8aee970044116.exe
2828	da8fee4a89f0b7cee6c8aee970044116.exe
2828	da8fee4a89f0b7cee6c8aee970044116.exe
2828	da8fee4a89f0b7cee6c8aee970044116.exe
2828	da8fee4a89f0b7cee6c8aee970044116.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2828	da8fee4a89f0b7cee6c8aee970044116.exe
Token: SeSecurityPrivilege	2828	da8fee4a89f0b7cee6c8aee970044116.exe
Token: SeTakeOwnershipPrivilege	2828	da8fee4a89f0b7cee6c8aee970044116.exe
Token: SeLoadDriverPrivilege	2828	da8fee4a89f0b7cee6c8aee970044116.exe
Token: SeSystemProfilePrivilege	2828	da8fee4a89f0b7cee6c8aee970044116.exe
Token: SeSystemtimePrivilege	2828	da8fee4a89f0b7cee6c8aee970044116.exe
Token: SeProfSingleProcessPrivilege	2828	da8fee4a89f0b7cee6c8aee970044116.exe
Token: SeIncBasePriorityPrivilege	2828	da8fee4a89f0b7cee6c8aee970044116.exe
Token: SeCreatePagefilePrivilege	2828	da8fee4a89f0b7cee6c8aee970044116.exe
Token: SeBackupPrivilege	2828	da8fee4a89f0b7cee6c8aee970044116.exe
Token: SeRestorePrivilege	2828	da8fee4a89f0b7cee6c8aee970044116.exe
Token: SeShutdownPrivilege	2828	da8fee4a89f0b7cee6c8aee970044116.exe
Token: SeDebugPrivilege	2828	da8fee4a89f0b7cee6c8aee970044116.exe
Token: SeSystemEnvironmentPrivilege	2828	da8fee4a89f0b7cee6c8aee970044116.exe
Token: SeRemoteShutdownPrivilege	2828	da8fee4a89f0b7cee6c8aee970044116.exe
Token: SeUndockPrivilege	2828	da8fee4a89f0b7cee6c8aee970044116.exe
Token: SeManageVolumePrivilege	2828	da8fee4a89f0b7cee6c8aee970044116.exe
Token: 33	2828	da8fee4a89f0b7cee6c8aee970044116.exe
Token: 34	2828	da8fee4a89f0b7cee6c8aee970044116.exe
Token: 35	2828	da8fee4a89f0b7cee6c8aee970044116.exe

C:\Users\Admin\AppData\Local\Temp\da8fee4a89f0b7cee6c8aee970044116.exe
"C:\Users\Admin\AppData\Local\Temp\da8fee4a89f0b7cee6c8aee970044116.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\4590A5356D41623000030\4590A5356D41623000030.exe

Filesize
302KB

MD5
da8fee4a89f0b7cee6c8aee970044116

SHA1
226a6fbd66992a0f2ddbf5d7572fab2cf8f5001e

SHA256
4a55da3c91388a8ea539fc750b52dd90af5d2f33f2e7269a73c2146243ed24cd

SHA512
9174bd1c379ed76be342400949a1e431a6430297485fd9c48ed12c60e7de94817b75d645c4ebb17b3a79d66ba813c40c36527f912e927a8ec27e4668d9c09dd8

Download Submit