67fa0375d6a6c5eb9b70420ccd24d3eedfe33f740060085a73e6a5f41e09a126 | Triage

Analysis

max time kernel
152s
max time network
160s
platform
windows7_x64
resource
win7-en-20211208
submitted
12-02-2022 04:00

Sharing

Report Analysis Logs

General

Target

67fa0375d6a6c5eb9b70420ccd24d3eedfe33f740060085a73e6a5f41e09a126.exe
Size

8KB
MD5

88583bf9e3090217670b708735a906fe
SHA1

5f60db6bd6c64b4b874e5daa7b1299efb9600b33
SHA256

67fa0375d6a6c5eb9b70420ccd24d3eedfe33f740060085a73e6a5f41e09a126
SHA512

3507901f3a6ac538611e9ef44ea36641a1b8aa04c312273fe3c969808ac8c21ccc5758874e0fb9297d1466578758558bae57bb910b98d19927b7ee47d66cbc08

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

67fa0375d6a6c5eb9b70420ccd24d3eedfe33f740060085a73e6a5f41e09a126.exe

description pid process

Token: SeDebugPrivilege 1204 67fa0375d6a6c5eb9b70420ccd24d3eedfe33f740060085a73e6a5f41e09a126.exe

C:\Users\Admin\AppData\Local\Temp\67fa0375d6a6c5eb9b70420ccd24d3eedfe33f740060085a73e6a5f41e09a126.exe
"C:\Users\Admin\AppData\Local\Temp\67fa0375d6a6c5eb9b70420ccd24d3eedfe33f740060085a73e6a5f41e09a126.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1204

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1204-54-0x0000000000B10000-0x0000000000B18000-memory.dmp

Filesize
32KB

Download
memory/1204-55-0x000007FEF5903000-0x000007FEF5904000-memory.dmp

Filesize
4KB

Download
memory/1204-56-0x000000001B070000-0x000000001B072000-memory.dmp

Filesize
8KB

Download