8671989853c9f4dd07adedf6a825cc9def8723a73b6308d2aa749f7f03c9f2be | Triage

Analysis

max time kernel
38s
max time network
126s
platform
windows7_x64
resource
win7v20210408
submitted
13/06/2021, 11:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

239E62A661C7CC6DC366AB83322C2372.exe
Size

9.7MB
MD5

239e62a661c7cc6dc366ab83322c2372
SHA1

0ea25009df50fd0837a65908b5f712da99f59e46
SHA256

8671989853c9f4dd07adedf6a825cc9def8723a73b6308d2aa749f7f03c9f2be
SHA512

7b7dbab9bb9eb1340ef896a56b57dfd4abd52e74e2cc18cd4458f34276c5b955314fba6bcfb7a134216926838dbde4e6eb97eb2cb1cb4c0f5d299c1ec116d541

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1612	239E62A661C7CC6DC366AB83322C2372.exe
1612	239E62A661C7CC6DC366AB83322C2372.exe
1612	239E62A661C7CC6DC366AB83322C2372.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1612	239E62A661C7CC6DC366AB83322C2372.exe

C:\Users\Admin\AppData\Local\Temp\239E62A661C7CC6DC366AB83322C2372.exe
"C:\Users\Admin\AppData\Local\Temp\239E62A661C7CC6DC366AB83322C2372.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1612-59-0x0000000001240000-0x0000000001241000-memory.dmp

Filesize
4KB

Download
memory/1612-61-0x000000001BE20000-0x000000001BE22000-memory.dmp

Filesize
8KB

Download