Analysis
-
max time kernel
143s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
18-12-2024 02:19
Static task
static1
Behavioral task
behavioral1
Sample
2ea05b5b9847fb2e777f4433a2f73cba12b96a8b074ab83179cbafbc49963665.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2ea05b5b9847fb2e777f4433a2f73cba12b96a8b074ab83179cbafbc49963665.exe
Resource
win10v2004-20241007-en
General
-
Target
2ea05b5b9847fb2e777f4433a2f73cba12b96a8b074ab83179cbafbc49963665.exe
-
Size
305KB
-
MD5
bfae2c479a12cbc660e580a84d3e3ce0
-
SHA1
0891b36b510049ef811deb93fcdacfdfdbfc406a
-
SHA256
2ea05b5b9847fb2e777f4433a2f73cba12b96a8b074ab83179cbafbc49963665
-
SHA512
ce53e1e95eee76f0f49e29b91ce27c35c972980ebd8e3ea2da387af40c667cae457288e183447e0513ed1c9ec0c4de5af6f81daddd77c533c437ee8496d59085
-
SSDEEP
6144:RJRGyoPwcMZAwSYQ1rL4OgbDetMfhiRdsLoOJ0tYRVlOPAKePNO4:dGyoPwcMZhnQ1rL4OKDeohi3sLo7WY4
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Users\\Admin\\AppData\\Roaming\\EDF18F729E161117388365\\EDF18F729E161117388365.exe" 2ea05b5b9847fb2e777f4433a2f73cba12b96a8b074ab83179cbafbc49963665.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 376 2ea05b5b9847fb2e777f4433a2f73cba12b96a8b074ab83179cbafbc49963665.exe 376 2ea05b5b9847fb2e777f4433a2f73cba12b96a8b074ab83179cbafbc49963665.exe 376 2ea05b5b9847fb2e777f4433a2f73cba12b96a8b074ab83179cbafbc49963665.exe 376 2ea05b5b9847fb2e777f4433a2f73cba12b96a8b074ab83179cbafbc49963665.exe 376 2ea05b5b9847fb2e777f4433a2f73cba12b96a8b074ab83179cbafbc49963665.exe 376 2ea05b5b9847fb2e777f4433a2f73cba12b96a8b074ab83179cbafbc49963665.exe 376 2ea05b5b9847fb2e777f4433a2f73cba12b96a8b074ab83179cbafbc49963665.exe 376 2ea05b5b9847fb2e777f4433a2f73cba12b96a8b074ab83179cbafbc49963665.exe 376 2ea05b5b9847fb2e777f4433a2f73cba12b96a8b074ab83179cbafbc49963665.exe 376 2ea05b5b9847fb2e777f4433a2f73cba12b96a8b074ab83179cbafbc49963665.exe 376 2ea05b5b9847fb2e777f4433a2f73cba12b96a8b074ab83179cbafbc49963665.exe 376 2ea05b5b9847fb2e777f4433a2f73cba12b96a8b074ab83179cbafbc49963665.exe -
Suspicious use of AdjustPrivilegeToken 20 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 376 2ea05b5b9847fb2e777f4433a2f73cba12b96a8b074ab83179cbafbc49963665.exe Token: SeSecurityPrivilege 376 2ea05b5b9847fb2e777f4433a2f73cba12b96a8b074ab83179cbafbc49963665.exe Token: SeTakeOwnershipPrivilege 376 2ea05b5b9847fb2e777f4433a2f73cba12b96a8b074ab83179cbafbc49963665.exe Token: SeLoadDriverPrivilege 376 2ea05b5b9847fb2e777f4433a2f73cba12b96a8b074ab83179cbafbc49963665.exe Token: SeSystemProfilePrivilege 376 2ea05b5b9847fb2e777f4433a2f73cba12b96a8b074ab83179cbafbc49963665.exe Token: SeSystemtimePrivilege 376 2ea05b5b9847fb2e777f4433a2f73cba12b96a8b074ab83179cbafbc49963665.exe Token: SeProfSingleProcessPrivilege 376 2ea05b5b9847fb2e777f4433a2f73cba12b96a8b074ab83179cbafbc49963665.exe Token: SeIncBasePriorityPrivilege 376 2ea05b5b9847fb2e777f4433a2f73cba12b96a8b074ab83179cbafbc49963665.exe Token: SeCreatePagefilePrivilege 376 2ea05b5b9847fb2e777f4433a2f73cba12b96a8b074ab83179cbafbc49963665.exe Token: SeBackupPrivilege 376 2ea05b5b9847fb2e777f4433a2f73cba12b96a8b074ab83179cbafbc49963665.exe Token: SeRestorePrivilege 376 2ea05b5b9847fb2e777f4433a2f73cba12b96a8b074ab83179cbafbc49963665.exe Token: SeShutdownPrivilege 376 2ea05b5b9847fb2e777f4433a2f73cba12b96a8b074ab83179cbafbc49963665.exe Token: SeDebugPrivilege 376 2ea05b5b9847fb2e777f4433a2f73cba12b96a8b074ab83179cbafbc49963665.exe Token: SeSystemEnvironmentPrivilege 376 2ea05b5b9847fb2e777f4433a2f73cba12b96a8b074ab83179cbafbc49963665.exe Token: SeRemoteShutdownPrivilege 376 2ea05b5b9847fb2e777f4433a2f73cba12b96a8b074ab83179cbafbc49963665.exe Token: SeUndockPrivilege 376 2ea05b5b9847fb2e777f4433a2f73cba12b96a8b074ab83179cbafbc49963665.exe Token: SeManageVolumePrivilege 376 2ea05b5b9847fb2e777f4433a2f73cba12b96a8b074ab83179cbafbc49963665.exe Token: 33 376 2ea05b5b9847fb2e777f4433a2f73cba12b96a8b074ab83179cbafbc49963665.exe Token: 34 376 2ea05b5b9847fb2e777f4433a2f73cba12b96a8b074ab83179cbafbc49963665.exe Token: 35 376 2ea05b5b9847fb2e777f4433a2f73cba12b96a8b074ab83179cbafbc49963665.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ea05b5b9847fb2e777f4433a2f73cba12b96a8b074ab83179cbafbc49963665.exe"C:\Users\Admin\AppData\Local\Temp\2ea05b5b9847fb2e777f4433a2f73cba12b96a8b074ab83179cbafbc49963665.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:376
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
305KB
MD5bfae2c479a12cbc660e580a84d3e3ce0
SHA10891b36b510049ef811deb93fcdacfdfdbfc406a
SHA2562ea05b5b9847fb2e777f4433a2f73cba12b96a8b074ab83179cbafbc49963665
SHA512ce53e1e95eee76f0f49e29b91ce27c35c972980ebd8e3ea2da387af40c667cae457288e183447e0513ed1c9ec0c4de5af6f81daddd77c533c437ee8496d59085