Analysis
-
max time kernel
143s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
16-12-2024 09:06
Static task
static1
Behavioral task
behavioral1
Sample
02701f8d91714c583decdd43635ff407.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
02701f8d91714c583decdd43635ff407.exe
Resource
win10v2004-20241007-en
General
-
Target
02701f8d91714c583decdd43635ff407.exe
-
Size
302KB
-
MD5
02701f8d91714c583decdd43635ff407
-
SHA1
855b8eeffcd217735d1ba6395bbb6647140ecca4
-
SHA256
41ba86941c72b5e160359e4b851251350958ca56e1d5aa897f0917eb51c5bd2e
-
SHA512
42930c89943297413933857c8ceac9eec924ce3093fd78da8f75930abdda540407781caf2fe32d4e7019cbd20171485a9d6389b4c03b0600edbaac597577c599
-
SSDEEP
6144:gJEAvoYumbeaLVA/HmH6iWmZx/M+VK0l//OBYJ0tYRVpG2DbY:DAvoYumb9VA/m9WmZxlVK0l/h/DbY
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Users\\Admin\\AppData\\Roaming\\77E8AED334EF58492808\\77E8AED334EF58492808.exe" 02701f8d91714c583decdd43635ff407.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 1628 02701f8d91714c583decdd43635ff407.exe 1628 02701f8d91714c583decdd43635ff407.exe 1628 02701f8d91714c583decdd43635ff407.exe 1628 02701f8d91714c583decdd43635ff407.exe 1628 02701f8d91714c583decdd43635ff407.exe 1628 02701f8d91714c583decdd43635ff407.exe 1628 02701f8d91714c583decdd43635ff407.exe 1628 02701f8d91714c583decdd43635ff407.exe 1628 02701f8d91714c583decdd43635ff407.exe 1628 02701f8d91714c583decdd43635ff407.exe 1628 02701f8d91714c583decdd43635ff407.exe 1628 02701f8d91714c583decdd43635ff407.exe -
Suspicious use of AdjustPrivilegeToken 20 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1628 02701f8d91714c583decdd43635ff407.exe Token: SeSecurityPrivilege 1628 02701f8d91714c583decdd43635ff407.exe Token: SeTakeOwnershipPrivilege 1628 02701f8d91714c583decdd43635ff407.exe Token: SeLoadDriverPrivilege 1628 02701f8d91714c583decdd43635ff407.exe Token: SeSystemProfilePrivilege 1628 02701f8d91714c583decdd43635ff407.exe Token: SeSystemtimePrivilege 1628 02701f8d91714c583decdd43635ff407.exe Token: SeProfSingleProcessPrivilege 1628 02701f8d91714c583decdd43635ff407.exe Token: SeIncBasePriorityPrivilege 1628 02701f8d91714c583decdd43635ff407.exe Token: SeCreatePagefilePrivilege 1628 02701f8d91714c583decdd43635ff407.exe Token: SeBackupPrivilege 1628 02701f8d91714c583decdd43635ff407.exe Token: SeRestorePrivilege 1628 02701f8d91714c583decdd43635ff407.exe Token: SeShutdownPrivilege 1628 02701f8d91714c583decdd43635ff407.exe Token: SeDebugPrivilege 1628 02701f8d91714c583decdd43635ff407.exe Token: SeSystemEnvironmentPrivilege 1628 02701f8d91714c583decdd43635ff407.exe Token: SeRemoteShutdownPrivilege 1628 02701f8d91714c583decdd43635ff407.exe Token: SeUndockPrivilege 1628 02701f8d91714c583decdd43635ff407.exe Token: SeManageVolumePrivilege 1628 02701f8d91714c583decdd43635ff407.exe Token: 33 1628 02701f8d91714c583decdd43635ff407.exe Token: 34 1628 02701f8d91714c583decdd43635ff407.exe Token: 35 1628 02701f8d91714c583decdd43635ff407.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
302KB
MD502701f8d91714c583decdd43635ff407
SHA1855b8eeffcd217735d1ba6395bbb6647140ecca4
SHA25641ba86941c72b5e160359e4b851251350958ca56e1d5aa897f0917eb51c5bd2e
SHA51242930c89943297413933857c8ceac9eec924ce3093fd78da8f75930abdda540407781caf2fe32d4e7019cbd20171485a9d6389b4c03b0600edbaac597577c599