Analysis
-
max time kernel
143s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
15-12-2024 08:17
Static task
static1
Behavioral task
behavioral1
Sample
da8fee4a89f0b7cee6c8aee970044116.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
da8fee4a89f0b7cee6c8aee970044116.exe
Resource
win10v2004-20241007-en
General
-
Target
da8fee4a89f0b7cee6c8aee970044116.exe
-
Size
302KB
-
MD5
da8fee4a89f0b7cee6c8aee970044116
-
SHA1
226a6fbd66992a0f2ddbf5d7572fab2cf8f5001e
-
SHA256
4a55da3c91388a8ea539fc750b52dd90af5d2f33f2e7269a73c2146243ed24cd
-
SHA512
9174bd1c379ed76be342400949a1e431a6430297485fd9c48ed12c60e7de94817b75d645c4ebb17b3a79d66ba813c40c36527f912e927a8ec27e4668d9c09dd8
-
SSDEEP
6144:CJqAvoYumbeaLVA/HmH6iWmZx/M+VK0lA/OBYJ0tYRVxG2PTY:3AvoYumb9VA/m9WmZxlVK0lAZ/PTY
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Users\\Admin\\AppData\\Roaming\\B1B54A9E6DE23994880753\\B1B54A9E6DE23994880753.exe" da8fee4a89f0b7cee6c8aee970044116.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 1688 da8fee4a89f0b7cee6c8aee970044116.exe 1688 da8fee4a89f0b7cee6c8aee970044116.exe 1688 da8fee4a89f0b7cee6c8aee970044116.exe 1688 da8fee4a89f0b7cee6c8aee970044116.exe 1688 da8fee4a89f0b7cee6c8aee970044116.exe 1688 da8fee4a89f0b7cee6c8aee970044116.exe 1688 da8fee4a89f0b7cee6c8aee970044116.exe 1688 da8fee4a89f0b7cee6c8aee970044116.exe 1688 da8fee4a89f0b7cee6c8aee970044116.exe 1688 da8fee4a89f0b7cee6c8aee970044116.exe 1688 da8fee4a89f0b7cee6c8aee970044116.exe 1688 da8fee4a89f0b7cee6c8aee970044116.exe -
Suspicious use of AdjustPrivilegeToken 20 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1688 da8fee4a89f0b7cee6c8aee970044116.exe Token: SeSecurityPrivilege 1688 da8fee4a89f0b7cee6c8aee970044116.exe Token: SeTakeOwnershipPrivilege 1688 da8fee4a89f0b7cee6c8aee970044116.exe Token: SeLoadDriverPrivilege 1688 da8fee4a89f0b7cee6c8aee970044116.exe Token: SeSystemProfilePrivilege 1688 da8fee4a89f0b7cee6c8aee970044116.exe Token: SeSystemtimePrivilege 1688 da8fee4a89f0b7cee6c8aee970044116.exe Token: SeProfSingleProcessPrivilege 1688 da8fee4a89f0b7cee6c8aee970044116.exe Token: SeIncBasePriorityPrivilege 1688 da8fee4a89f0b7cee6c8aee970044116.exe Token: SeCreatePagefilePrivilege 1688 da8fee4a89f0b7cee6c8aee970044116.exe Token: SeBackupPrivilege 1688 da8fee4a89f0b7cee6c8aee970044116.exe Token: SeRestorePrivilege 1688 da8fee4a89f0b7cee6c8aee970044116.exe Token: SeShutdownPrivilege 1688 da8fee4a89f0b7cee6c8aee970044116.exe Token: SeDebugPrivilege 1688 da8fee4a89f0b7cee6c8aee970044116.exe Token: SeSystemEnvironmentPrivilege 1688 da8fee4a89f0b7cee6c8aee970044116.exe Token: SeRemoteShutdownPrivilege 1688 da8fee4a89f0b7cee6c8aee970044116.exe Token: SeUndockPrivilege 1688 da8fee4a89f0b7cee6c8aee970044116.exe Token: SeManageVolumePrivilege 1688 da8fee4a89f0b7cee6c8aee970044116.exe Token: 33 1688 da8fee4a89f0b7cee6c8aee970044116.exe Token: 34 1688 da8fee4a89f0b7cee6c8aee970044116.exe Token: 35 1688 da8fee4a89f0b7cee6c8aee970044116.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
302KB
MD5da8fee4a89f0b7cee6c8aee970044116
SHA1226a6fbd66992a0f2ddbf5d7572fab2cf8f5001e
SHA2564a55da3c91388a8ea539fc750b52dd90af5d2f33f2e7269a73c2146243ed24cd
SHA5129174bd1c379ed76be342400949a1e431a6430297485fd9c48ed12c60e7de94817b75d645c4ebb17b3a79d66ba813c40c36527f912e927a8ec27e4668d9c09dd8