5a9468a87997f2363995e264505105f6a235b66543bb28635fb74f78704e9111 | Triage

Analysis

max time kernel
120s
max time network
140s
platform
windows7_x64
resource
win7-en-20211208
submitted
31-01-2022 21:03

Sharing

Report Analysis Logs

General

Target

5a9468a87997f2363995e264505105f6a235b66543bb28635fb74f78704e9111.exe
Size

203KB
MD5

75758f7b5ce71fa918c1c7c68d3bd524
SHA1

4a6ac65f6f8304bacbf176fce156cc0393aae565
SHA256

5a9468a87997f2363995e264505105f6a235b66543bb28635fb74f78704e9111
SHA512

0d6ee5345777439f69fb5b49ef7ba7687bc40467d618f77e1c81ba08ef645e1596f3019496b2df7e229ae1f274edb17cdc81124a7ca0a6478a157ca6865fae7a

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

5a9468a87997f2363995e264505105f6a235b66543bb28635fb74f78704e9111.exe

description	pid	process
Token: SeDebugPrivilege	748	5a9468a87997f2363995e264505105f6a235b66543bb28635fb74f78704e9111.exe
Token: SeTcbPrivilege	748	5a9468a87997f2363995e264505105f6a235b66543bb28635fb74f78704e9111.exe

C:\Users\Admin\AppData\Local\Temp\5a9468a87997f2363995e264505105f6a235b66543bb28635fb74f78704e9111.exe
"C:\Users\Admin\AppData\Local\Temp\5a9468a87997f2363995e264505105f6a235b66543bb28635fb74f78704e9111.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:748

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/748-54-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download