b936374e92804a2c1899bd62adbeb21c5bf773811dfed73c7cbe519a269723e6 | Triage

Analysis

max time kernel
73s
max time network
121s
platform
windows10_x64
resource
win10
submitted
09-07-2020 12:34

Sharing

Report Analysis Logs

General

Target

b936374e92804a2c1899bd62adbeb21c5bf773811dfed73c7cbe519a269723e6.exe
Size

22KB
MD5

9e81a4350ab3225a4d5a9a17b1c34bcb
SHA1

c23f0551c2f7937ea4ad4b970b01cbd4d104effe
SHA256

b936374e92804a2c1899bd62adbeb21c5bf773811dfed73c7cbe519a269723e6
SHA512

d2017522e68bfdd14f9cb06381b3699498efb25f695bc67bf70d911debc0b3c09e4088e775424dbccdebf650fe0c6da4f661d468642ad9f32eeb869e2577c394

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b936374e92804a2c1899bd62adbeb21c5bf773811dfed73c7cbe519a269723e6.exe

description pid process

Token: SeDebugPrivilege 3104 b936374e92804a2c1899bd62adbeb21c5bf773811dfed73c7cbe519a269723e6.exe

Modifies control panel 1 IoCs

Processes:

b936374e92804a2c1899bd62adbeb21c5bf773811dfed73c7cbe519a269723e6.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Control Panel\Cursors\AppStarting = "%SystemRoot%\\cursors\\aero_arrow.cur"	b936374e92804a2c1899bd62adbeb21c5bf773811dfed73c7cbe519a269723e6.exe

C:\Users\Admin\AppData\Local\Temp\b936374e92804a2c1899bd62adbeb21c5bf773811dfed73c7cbe519a269723e6.exe
"C:\Users\Admin\AppData\Local\Temp\b936374e92804a2c1899bd62adbeb21c5bf773811dfed73c7cbe519a269723e6.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Modifies control panel
PID:3104

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...