0b3ca8fc417a9e5ac4101babf092999399fe7aadc4d8b68b4707e8297db0a08e | Triage

Analysis

max time kernel
167s
max time network
139s
platform
windows7_x64
resource
win7-en-20211208
submitted
01-02-2022 12:56

Sharing

Report Analysis Logs

General

Target

0b3ca8fc417a9e5ac4101babf092999399fe7aadc4d8b68b4707e8297db0a08e.exe
Size

16KB
MD5

99250e771feb3b70e4122bbc54a79f8e
SHA1

432d8117bc544918bdaecc01c6ce68305cfd2e86
SHA256

0b3ca8fc417a9e5ac4101babf092999399fe7aadc4d8b68b4707e8297db0a08e
SHA512

6f0bc3b1c7a73009d1ca71a3ad08fcf76d66e32e25cba9d7a547e95b178b1d5dd4699c07beb49add607063513c37158809ed640e1deb9011265b1bdf9f7fd284

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0b3ca8fc417a9e5ac4101babf092999399fe7aadc4d8b68b4707e8297db0a08e.exe

description pid process

Token: SeDebugPrivilege 948 0b3ca8fc417a9e5ac4101babf092999399fe7aadc4d8b68b4707e8297db0a08e.exe

C:\Users\Admin\AppData\Local\Temp\0b3ca8fc417a9e5ac4101babf092999399fe7aadc4d8b68b4707e8297db0a08e.exe
"C:\Users\Admin\AppData\Local\Temp\0b3ca8fc417a9e5ac4101babf092999399fe7aadc4d8b68b4707e8297db0a08e.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/948-55-0x00000000020C0000-0x00000000020C2000-memory.dmp

Filesize
8KB

Download
memory/948-56-0x000007FEF2840000-0x000007FEF38D6000-memory.dmp

Filesize
16.6MB

Download