5ba0618abff351a051f3abc3b4831376d478ca38c10e6165453c14cb3b19590f | Triage

Analysis

max time kernel
154s
max time network
164s
platform
windows7_x64
resource
win7-en-20211208
submitted
21/01/2022, 23:48

Sharing

Report Analysis Logs

General

Target

5ba0618abff351a051f3abc3b4831376d478ca38c10e6165453c14cb3b19590f.exe
Size

9.6MB
MD5

ee9b42e6f6bb15a436af0576122cd9c8
SHA1

c3e02cef97d23944cf82da26bb74584d6795ce25
SHA256

5ba0618abff351a051f3abc3b4831376d478ca38c10e6165453c14cb3b19590f
SHA512

75ee10fe48415db1fca76bdee502dae142ccb90d8d76e5408f3a5df5469df2f4edd84758aa6e32c08a28f34e9f5bf67f8809e471b58d402bdc58ac357fa779c5

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1752	5ba0618abff351a051f3abc3b4831376d478ca38c10e6165453c14cb3b19590f.exe

C:\Users\Admin\AppData\Local\Temp\5ba0618abff351a051f3abc3b4831376d478ca38c10e6165453c14cb3b19590f.exe
"C:\Users\Admin\AppData\Local\Temp\5ba0618abff351a051f3abc3b4831376d478ca38c10e6165453c14cb3b19590f.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1752-55-0x0000000000DA0000-0x000000000174C000-memory.dmp

Filesize
9.7MB

Download
memory/1752-56-0x00000000769D1000-0x00000000769D3000-memory.dmp

Filesize
8KB

Download
memory/1752-57-0x0000000005740000-0x0000000005741000-memory.dmp

Filesize
4KB

Download