5bbabb2462f89003e7dcfb31aa700cf20573d6813bda784f1c24b4cc913d57f9 | Triage

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7v20201028
submitted
06-11-2020 11:12

Sharing

Report Analysis Logs

General

Target

5bbabb2462f89003e7dcfb31aa700cf20573d6813bda784f1c24b4cc913d57f9.exe
Size

16KB
MD5

c40cc1e86c9759a61f80052991c213a6
SHA1

196a4b21e3620e54a8613461e8d7ca5e2d598c03
SHA256

5bbabb2462f89003e7dcfb31aa700cf20573d6813bda784f1c24b4cc913d57f9
SHA512

87eb42778bc700bd2109eb3fed1de2ed4458807482a1db5b3ca84ee8840e9e43aa947de4a200229e8a759056603ef4e4562be34f2f1ec080aed8189b8b3dbf78

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

5bbabb2462f89003e7dcfb31aa700cf20573d6813bda784f1c24b4cc913d57f9.exe

description pid process

Token: SeDebugPrivilege 288 5bbabb2462f89003e7dcfb31aa700cf20573d6813bda784f1c24b4cc913d57f9.exe

C:\Users\Admin\AppData\Local\Temp\5bbabb2462f89003e7dcfb31aa700cf20573d6813bda784f1c24b4cc913d57f9.exe
"C:\Users\Admin\AppData\Local\Temp\5bbabb2462f89003e7dcfb31aa700cf20573d6813bda784f1c24b4cc913d57f9.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/288-0-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp

Filesize
9.6MB

Download
memory/288-1-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp

Filesize
9.6MB

Download