fe04712df428e50a363a85db3bfe4503cad0b67449175f12a1a5eaff656348da | Triage

Analysis

max time kernel
148s
max time network
154s
platform
windows10_x64
resource
win10-en-20211208
submitted
21/01/2022, 22:49

Sharing

Report Analysis Logs

General

Target

fe04712df428e50a363a85db3bfe4503cad0b67449175f12a1a5eaff656348da.exe
Size

9.7MB
MD5

5800ee7adeb563532bba5477f6af571d
SHA1

000665d287552cd4c4198ee7160c758832e047ea
SHA256

fe04712df428e50a363a85db3bfe4503cad0b67449175f12a1a5eaff656348da
SHA512

53e66c657fc0fc7958c5cc4720d4910fd3940f0c716368da9d7b91225171dd5ccdc86f32b67694fd4f799da19343df39434e2bf4fa04fc40a426f3bfc42c1378

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2464	fe04712df428e50a363a85db3bfe4503cad0b67449175f12a1a5eaff656348da.exe
2464	fe04712df428e50a363a85db3bfe4503cad0b67449175f12a1a5eaff656348da.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2464	fe04712df428e50a363a85db3bfe4503cad0b67449175f12a1a5eaff656348da.exe

C:\Users\Admin\AppData\Local\Temp\fe04712df428e50a363a85db3bfe4503cad0b67449175f12a1a5eaff656348da.exe
"C:\Users\Admin\AppData\Local\Temp\fe04712df428e50a363a85db3bfe4503cad0b67449175f12a1a5eaff656348da.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2464-115-0x0000000003770000-0x0000000003772000-memory.dmp

Filesize
8KB

Download
memory/2464-116-0x0000000003772000-0x0000000003774000-memory.dmp

Filesize
8KB

Download