86612cbb8895f4b594dd10bcf8d10840703f429c8bde73bd99a99d9ded8ef2cf

Analysis

max time kernel
361s
max time network
362s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27-12-2024 16:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

guksefsfwad.exe
Size

1.2MB
MD5

42819f664dd1874ccc1f83d39ecb01d7
SHA1

c067fc11c5a03c4d179848ebe065bef670e3b501
SHA256

86612cbb8895f4b594dd10bcf8d10840703f429c8bde73bd99a99d9ded8ef2cf
SHA512

3d2085c2be5d3291d9a2a09294fcb485e1acbcfb4314b4d3a7cc103420fc126544bf25f0a364a1bbe91b521a8ad3aa17c54cfd3f9e8c11d6c61b4e20fde71a98
SSDEEP

24576:28wnXXnncHLI8JQpR0s9MjemJ5lx1w6Qh0lhSMXl5uCTOd:DMXXncHLIJ+s+egDx+6lpVTa

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Control Panel\International\Geo\Nation	guksefsfwad.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1964	guksefsfwad.exe
Token: SeImpersonatePrivilege	1964	guksefsfwad.exe

C:\Users\Admin\AppData\Local\Temp\guksefsfwad.exe
"C:\Users\Admin\AppData\Local\Temp\guksefsfwad.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
PID:1964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads