df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731 | Triage

Analysis

max time kernel
97s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
06/05/2022, 19:46

Sharing

Report Analysis Logs

General

Target

df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe
Size

100KB
MD5

c7a310982da68b10360854f9cd78e718
SHA1

60140c28e0b7db797a771c2dee081fa3812246db
SHA256

df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731
SHA512

6747fa3f7637922eeaa0feeb25d430dc6ab66fd9f3d22e7e5fd16bad9b75528a8174c34a8baf681950b64e8cdaa6a14e37633592e843c363e75468622ebd2ec3

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5112	df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe

C:\Users\Admin\AppData\Local\Temp\df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe
"C:\Users\Admin\AppData\Local\Temp\df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5112-130-0x00000000002B0000-0x00000000002CE000-memory.dmp

Filesize
120KB

Download
memory/5112-131-0x00000000052E0000-0x0000000005884000-memory.dmp

Filesize
5.6MB

Download
memory/5112-132-0x0000000004B80000-0x0000000004C12000-memory.dmp

Filesize
584KB

Download
memory/5112-133-0x0000000004D30000-0x0000000004D3A000-memory.dmp

Filesize
40KB

Download