33bca0b7c35d92fe1dec4638d803349ca76a0f4b2a647efa49697edb77d2ae95

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2024 13:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7zSCD97F9B7/61cf42d96bbd5_Fri1768e6cd.exe
Size

8KB
MD5

d7f55160e4884c2917c39d3ae7f618b3
SHA1

b8b48396d98f492c98f8c5f9ca88ef32f9d47033
SHA256

4b8d0340ceb7fe26b41c04c590bb68791865274132f73b0cd59265f3c63d96c8
SHA512

af49101f633a964b54fa3e8baf2d97bc0cade00f5087dd51b1b281991f808a82359664b36e3450662ff3fbd5ee9dd6ccebde547d14f15ee09ffee909124544a6
SSDEEP

96:MJOunDNLXqqCWV2sLZSukdrKozt1HfWP5KczNt:W2qH3LGr3H+Im

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 31 IoCs

Web Service

T1102

flow	ioc
64	iplogger.org
16	iplogger.org
45	iplogger.org
55	iplogger.org
62	iplogger.org
65	iplogger.org
66	iplogger.org
21	iplogger.org
38	iplogger.org
54	iplogger.org
70	iplogger.org
28	iplogger.org
44	iplogger.org
68	iplogger.org
46	iplogger.org
52	iplogger.org
61	iplogger.org
71	iplogger.org
63	iplogger.org
67	iplogger.org
3	iplogger.org
43	iplogger.org
47	iplogger.org
50	iplogger.org
51	iplogger.org
57	iplogger.org
4	iplogger.org
69	iplogger.org
17	iplogger.org
27	iplogger.org
53	iplogger.org

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	964	61cf42d96bbd5_Fri1768e6cd.exe

C:\Users\Admin\AppData\Local\Temp\7zSCD97F9B7\61cf42d96bbd5_Fri1768e6cd.exe
"C:\Users\Admin\AppData\Local\Temp\7zSCD97F9B7\61cf42d96bbd5_Fri1768e6cd.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/964-1-0x0000000000F10000-0x0000000000F18000-memory.dmp

Filesize
32KB

Download
memory/964-0-0x00007FF878A33000-0x00007FF878A35000-memory.dmp

Filesize
8KB

Download
memory/964-2-0x00007FF878A30000-0x00007FF8794F1000-memory.dmp

Filesize
10.8MB

Download
memory/964-3-0x00007FF878A30000-0x00007FF8794F1000-memory.dmp

Filesize
10.8MB

Download