6b2bfd934eb3ac332b909ed957468e7e74869c424c92a28995f30e8a46f3bad5 | Triage™

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
20/05/2022, 04:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6b2bfd934eb3ac332b909ed957468e7e74869c424c92a28995f30e8a46f3bad5.exe
Size 16KB
Sample220520-enlmpahbc7
SHA256 6b2bfd934eb3ac332b909ed957468e7e74869c424c92a28995f30e8a46f3bad5
MD5 65b1180b492002ebc48630e892176aa9
SHA1 e5124246076b02e6e72205d1520352322b06c0db
SHA512 dd465ca226250f5329cbf6bb58a946a4efb06b0944ada3db7e2347dcd85b10c0eaef0a2ae41ee48465cd9ffa7d77409c3944516cb56a7aa73eb201ddebad9ee7
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4684	6b2bfd934eb3ac332b909ed957468e7e74869c424c92a28995f30e8a46f3bad5.exe

C:\Users\Admin\AppData\Local\Temp\6b2bfd934eb3ac332b909ed957468e7e74869c424c92a28995f30e8a46f3bad5.exe
"C:\Users\Admin\AppData\Local\Temp\6b2bfd934eb3ac332b909ed957468e7e74869c424c92a28995f30e8a46f3bad5.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:3852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4684-130-0x00007FFB54150000-0x00007FFB54B86000-memory.dmp

Download