Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20250207-en -
resource tags
-
submitted
08-02-2025 07:02
General
-
Target
51b496b8fa5a4e76904fda94db9bc198ba844387c14824c22e54b9bd8f3aaa2a.exe
-
Size
1.2MB
-
MD5
0acbd0d7d6dbcf822a69c90b76b8d241
-
SHA1
96a28a982251c1f1a6e7aa36f2c8e63d03eb156d
-
SHA256
51b496b8fa5a4e76904fda94db9bc198ba844387c14824c22e54b9bd8f3aaa2a
-
SHA512
f146e9ed79958a36425393576ea550c44095120d064403ec4fad9eadac3fa44115caafefaf6c62c21ec6c530338f4d72d70e58a4eb3d6d9ef7112ca6b959cbcf
-
SSDEEP
24576:CSB2h5hXBThEpSszHazI/zSZEkL21GVWk2DSL0pJbJ7M:Ny/Xd2SmHaUu21SKpJV7M
Malware Config
Signatures
-
Downloads MZ/PE file 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\51b496b8fa5a4e76904fda94db9bc198ba844387c14824c22e54b9bd8f3aaa2a.exe"C:\Users\Admin\AppData\Local\Temp\51b496b8fa5a4e76904fda94db9bc198ba844387c14824c22e54b9bd8f3aaa2a.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource core1⤵
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MzEyOTc2NDUtNUIxQy00N0FFLThGQjItOEI5QTUyN0Y2Q0U5fSIgdXNlcmlkPSJ7QTA4QjgxN0ItMzc5OS00Qjc3LUJFNzAtMEJGRDZBOTY2NTU0fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7Mzg5OTk0QjUtMzQwOC00NTRDLUFCQzQtNzAxMTQzQzZBQzA4fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDU5MjEiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODE5ODA3NzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MTMzNTM1NzIwIi8-PC9hcHA-PC9yZXF1ZXN0Pg1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
402KB
MD5129add3ca22e9ef745467c2f34faa45e
SHA1ee5b83b8a1b94902663b3950b4c28b4a128e96a9
SHA256ab68230f25272a444610545fa0356b8d891857d879a9b7302b79d9e032df15b9
SHA512cae8808cf8712acc2b7e3964c18ab484a92d255e452514447fedfc178af626934a99665c7a403aa13b8512f9552a84691529090fff6c3ac7b9d2aaded65e897f
-
Filesize
224KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
32KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
56KB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
200KB