630eb275846bba559180078427521c38ac0b46fa673d9efe222937c63c6f8c1e | Triage

Analysis

max time kernel
11s
max time network
112s
platform
windows10_x64
resource
win10v20201028
submitted
05-11-2020 05:31

Sharing

Report Analysis Logs

General

Target

9776c30b3da247119ea6d9eb6b2da03c9087f2ea53a6fa9fcd9bebd6f18c8288.exe
Size

49KB
MD5

6b65c98e45e7bc9086ccf02e04379e4a
SHA1

f8c86d81813265a1ac99397136b779db146c28fe
SHA256

9776c30b3da247119ea6d9eb6b2da03c9087f2ea53a6fa9fcd9bebd6f18c8288
SHA512

380f1736c32c428f190446646580b7ace8060f2fbb7dfeb71cf330e2666fe88d2870870d3c283fe565e074447e3b8acb526cd4fe91c47f695624a13701db0898

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

9776c30b3da247119ea6d9eb6b2da03c9087f2ea53a6fa9fcd9bebd6f18c8288.exe

description pid process

Token: SeDebugPrivilege 412 9776c30b3da247119ea6d9eb6b2da03c9087f2ea53a6fa9fcd9bebd6f18c8288.exe

C:\Users\Admin\AppData\Local\Temp\9776c30b3da247119ea6d9eb6b2da03c9087f2ea53a6fa9fcd9bebd6f18c8288.exe
"C:\Users\Admin\AppData\Local\Temp\9776c30b3da247119ea6d9eb6b2da03c9087f2ea53a6fa9fcd9bebd6f18c8288.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:412

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/412-0-0x00007FF9E6E30000-0x00007FF9E77D0000-memory.dmp

Filesize
9.6MB

Download