fe04712df428e50a363a85db3bfe4503cad0b67449175f12a1a5eaff656348da | Triage

Analysis

max time kernel
150s
max time network
160s
platform
windows7_x64
resource
win7-en-20211208
submitted
21-01-2022 22:49

Sharing

Report Analysis Logs

General

Target

fe04712df428e50a363a85db3bfe4503cad0b67449175f12a1a5eaff656348da.exe
Size

9.7MB
MD5

5800ee7adeb563532bba5477f6af571d
SHA1

000665d287552cd4c4198ee7160c758832e047ea
SHA256

fe04712df428e50a363a85db3bfe4503cad0b67449175f12a1a5eaff656348da
SHA512

53e66c657fc0fc7958c5cc4720d4910fd3940f0c716368da9d7b91225171dd5ccdc86f32b67694fd4f799da19343df39434e2bf4fa04fc40a426f3bfc42c1378

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1540	fe04712df428e50a363a85db3bfe4503cad0b67449175f12a1a5eaff656348da.exe
1540	fe04712df428e50a363a85db3bfe4503cad0b67449175f12a1a5eaff656348da.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1540	fe04712df428e50a363a85db3bfe4503cad0b67449175f12a1a5eaff656348da.exe

C:\Users\Admin\AppData\Local\Temp\fe04712df428e50a363a85db3bfe4503cad0b67449175f12a1a5eaff656348da.exe
"C:\Users\Admin\AppData\Local\Temp\fe04712df428e50a363a85db3bfe4503cad0b67449175f12a1a5eaff656348da.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1540-54-0x0000000002A40000-0x0000000002A42000-memory.dmp

Filesize
8KB

Download
memory/1540-55-0x000007FEF2B50000-0x000007FEF3BE6000-memory.dmp

Filesize
16.6MB

Download
memory/1540-56-0x0000000002A46000-0x0000000002A65000-memory.dmp

Filesize
124KB

Download