Analysis

  • max time kernel
    1802s
  • max time network
    1822s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    20-11-2020 14:34

General

  • Target

    KLwC6vii.exe

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken ⋅ 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\KLwC6vii.exe
    "C:\Users\Admin\AppData\Local\Temp\KLwC6vii.exe"
    Suspicious use of AdjustPrivilegeToken
    PID:1404

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Discovery

            Execution

              Exfiltration

                Impact

                  Initial Access

                    Lateral Movement

                      Persistence

                        Privilege Escalation

                          Replay Monitor

                          00:00 00:00

                          Downloads

                          • memory/1404-0-0x00007FFB599C0000-0x00007FFB5A360000-memory.dmp