41ba86941c72b5e160359e4b851251350958ca56e1d5aa897f0917eb51c5bd2e

Analysis

max time kernel
143s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-12-2024 10:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41ba86941c72b5e160359e4b851251350958ca56e1d5aa897f0917eb51c5bd2e.exe
Size

302KB
MD5

02701f8d91714c583decdd43635ff407
SHA1

855b8eeffcd217735d1ba6395bbb6647140ecca4
SHA256

41ba86941c72b5e160359e4b851251350958ca56e1d5aa897f0917eb51c5bd2e
SHA512

42930c89943297413933857c8ceac9eec924ce3093fd78da8f75930abdda540407781caf2fe32d4e7019cbd20171485a9d6389b4c03b0600edbaac597577c599
SSDEEP

6144:gJEAvoYumbeaLVA/HmH6iWmZx/M+VK0l//OBYJ0tYRVpG2DbY:DAvoYumb9VA/m9WmZxlVK0l/h/DbY

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Users\\Admin\\AppData\\Roaming\\661E38778B73661179348\\661E38778B73661179348.exe"	41ba86941c72b5e160359e4b851251350958ca56e1d5aa897f0917eb51c5bd2e.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2668	41ba86941c72b5e160359e4b851251350958ca56e1d5aa897f0917eb51c5bd2e.exe
2668	41ba86941c72b5e160359e4b851251350958ca56e1d5aa897f0917eb51c5bd2e.exe
2668	41ba86941c72b5e160359e4b851251350958ca56e1d5aa897f0917eb51c5bd2e.exe
2668	41ba86941c72b5e160359e4b851251350958ca56e1d5aa897f0917eb51c5bd2e.exe
2668	41ba86941c72b5e160359e4b851251350958ca56e1d5aa897f0917eb51c5bd2e.exe
2668	41ba86941c72b5e160359e4b851251350958ca56e1d5aa897f0917eb51c5bd2e.exe
2668	41ba86941c72b5e160359e4b851251350958ca56e1d5aa897f0917eb51c5bd2e.exe
2668	41ba86941c72b5e160359e4b851251350958ca56e1d5aa897f0917eb51c5bd2e.exe
2668	41ba86941c72b5e160359e4b851251350958ca56e1d5aa897f0917eb51c5bd2e.exe
2668	41ba86941c72b5e160359e4b851251350958ca56e1d5aa897f0917eb51c5bd2e.exe
2668	41ba86941c72b5e160359e4b851251350958ca56e1d5aa897f0917eb51c5bd2e.exe
2668	41ba86941c72b5e160359e4b851251350958ca56e1d5aa897f0917eb51c5bd2e.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2668	41ba86941c72b5e160359e4b851251350958ca56e1d5aa897f0917eb51c5bd2e.exe
Token: SeSecurityPrivilege	2668	41ba86941c72b5e160359e4b851251350958ca56e1d5aa897f0917eb51c5bd2e.exe
Token: SeTakeOwnershipPrivilege	2668	41ba86941c72b5e160359e4b851251350958ca56e1d5aa897f0917eb51c5bd2e.exe
Token: SeLoadDriverPrivilege	2668	41ba86941c72b5e160359e4b851251350958ca56e1d5aa897f0917eb51c5bd2e.exe
Token: SeSystemProfilePrivilege	2668	41ba86941c72b5e160359e4b851251350958ca56e1d5aa897f0917eb51c5bd2e.exe
Token: SeSystemtimePrivilege	2668	41ba86941c72b5e160359e4b851251350958ca56e1d5aa897f0917eb51c5bd2e.exe
Token: SeProfSingleProcessPrivilege	2668	41ba86941c72b5e160359e4b851251350958ca56e1d5aa897f0917eb51c5bd2e.exe
Token: SeIncBasePriorityPrivilege	2668	41ba86941c72b5e160359e4b851251350958ca56e1d5aa897f0917eb51c5bd2e.exe
Token: SeCreatePagefilePrivilege	2668	41ba86941c72b5e160359e4b851251350958ca56e1d5aa897f0917eb51c5bd2e.exe
Token: SeBackupPrivilege	2668	41ba86941c72b5e160359e4b851251350958ca56e1d5aa897f0917eb51c5bd2e.exe
Token: SeRestorePrivilege	2668	41ba86941c72b5e160359e4b851251350958ca56e1d5aa897f0917eb51c5bd2e.exe
Token: SeShutdownPrivilege	2668	41ba86941c72b5e160359e4b851251350958ca56e1d5aa897f0917eb51c5bd2e.exe
Token: SeDebugPrivilege	2668	41ba86941c72b5e160359e4b851251350958ca56e1d5aa897f0917eb51c5bd2e.exe
Token: SeSystemEnvironmentPrivilege	2668	41ba86941c72b5e160359e4b851251350958ca56e1d5aa897f0917eb51c5bd2e.exe
Token: SeRemoteShutdownPrivilege	2668	41ba86941c72b5e160359e4b851251350958ca56e1d5aa897f0917eb51c5bd2e.exe
Token: SeUndockPrivilege	2668	41ba86941c72b5e160359e4b851251350958ca56e1d5aa897f0917eb51c5bd2e.exe
Token: SeManageVolumePrivilege	2668	41ba86941c72b5e160359e4b851251350958ca56e1d5aa897f0917eb51c5bd2e.exe
Token: 33	2668	41ba86941c72b5e160359e4b851251350958ca56e1d5aa897f0917eb51c5bd2e.exe
Token: 34	2668	41ba86941c72b5e160359e4b851251350958ca56e1d5aa897f0917eb51c5bd2e.exe
Token: 35	2668	41ba86941c72b5e160359e4b851251350958ca56e1d5aa897f0917eb51c5bd2e.exe

C:\Users\Admin\AppData\Local\Temp\41ba86941c72b5e160359e4b851251350958ca56e1d5aa897f0917eb51c5bd2e.exe
"C:\Users\Admin\AppData\Local\Temp\41ba86941c72b5e160359e4b851251350958ca56e1d5aa897f0917eb51c5bd2e.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\661E38778B73661179348\661E38778B73661179348.exe

Filesize
302KB

MD5
02701f8d91714c583decdd43635ff407

SHA1
855b8eeffcd217735d1ba6395bbb6647140ecca4

SHA256
41ba86941c72b5e160359e4b851251350958ca56e1d5aa897f0917eb51c5bd2e

SHA512
42930c89943297413933857c8ceac9eec924ce3093fd78da8f75930abdda540407781caf2fe32d4e7019cbd20171485a9d6389b4c03b0600edbaac597577c599

Download Submit