f8ee546f04fa175fa9a8b1f3de8595bd0a4f6aebfeed50a95c5e309d49063e1e | Triage

Analysis

max time kernel
60s
max time network
24s
platform
windows7_x64
resource
win7-en-20210920
submitted
26-10-2021 12:24

Sharing

Report Analysis Logs

General

Target

e13b24cda6737f13b2dc3f2c20d8823b.exe
Size

531KB
MD5

e13b24cda6737f13b2dc3f2c20d8823b
SHA1

b58a2436a4befb5b7465153a72f64fd17531644c
SHA256

f8ee546f04fa175fa9a8b1f3de8595bd0a4f6aebfeed50a95c5e309d49063e1e
SHA512

c8fd34d209a8659638e349a86fc39f76a11ee0a7a74afb4db479d7c00a6442194a3e3ff9aae41efb6acd065f2cf665342fd523aa19fe69cb95b0178f903b734c

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

e13b24cda6737f13b2dc3f2c20d8823b.exe

description pid process

Token: SeDebugPrivilege 1200 e13b24cda6737f13b2dc3f2c20d8823b.exe

C:\Users\Admin\AppData\Local\Temp\e13b24cda6737f13b2dc3f2c20d8823b.exe
"C:\Users\Admin\AppData\Local\Temp\e13b24cda6737f13b2dc3f2c20d8823b.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1200

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1200-53-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

Filesize
4KB

Download
memory/1200-55-0x0000000004730000-0x0000000004796000-memory.dmp

Filesize
408KB

Download
memory/1200-56-0x0000000005290000-0x0000000005291000-memory.dmp

Filesize
4KB

Download