bada7e61229d4c6bba936e8b163034b3421680c1f4ebbc69160fc96fc5bdb8ca | Triage

Analysis

max time kernel
81s
max time network
126s
platform
windows10_x64
resource
win10-en-20211208
submitted
22-01-2022 14:51

Sharing

Report Analysis Logs

General

Target

af1e6b53fc3e4679bedd29c25e057b10.exe
Size

3.9MB
MD5

af1e6b53fc3e4679bedd29c25e057b10
SHA1

f5a82edb61a2a0c896406b4cc48c9d1bd5bb082e
SHA256

bada7e61229d4c6bba936e8b163034b3421680c1f4ebbc69160fc96fc5bdb8ca
SHA512

009298300cb8e631c2d28f34268900d8015fe8bbd2e7c21f5eda320a76debea6057a8207d5b30c193f6a182064c4bafeca98ec502a713de70969040191fdedc6

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

af1e6b53fc3e4679bedd29c25e057b10.exe

description pid process

Token: SeDebugPrivilege 3988 af1e6b53fc3e4679bedd29c25e057b10.exe

C:\Users\Admin\AppData\Local\Temp\af1e6b53fc3e4679bedd29c25e057b10.exe
"C:\Users\Admin\AppData\Local\Temp\af1e6b53fc3e4679bedd29c25e057b10.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3988-115-0x0000000000930000-0x0000000000948000-memory.dmp

Filesize
96KB

Download
memory/3988-116-0x0000000005280000-0x0000000005281000-memory.dmp

Filesize
4KB

Download