829982cc1319f90eb5cbace3ca5a2e52148ba1da618873156153815d7b983f20 | Triage

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
20-05-2022 05:39

Sharing

Report Analysis Logs

General

Target

829982cc1319f90eb5cbace3ca5a2e52148ba1da618873156153815d7b983f20.exe
Size

288KB
MD5

e53b655b37b571125ea2756910e022fb
SHA1

b42df4cfc8631e29af31744ba245714fa689eca3
SHA256

829982cc1319f90eb5cbace3ca5a2e52148ba1da618873156153815d7b983f20
SHA512

e38d03f4af30406af02caa517da1328f20cf1b5c31f5daa8a95e2f2a7fb25ccc05d6baab7106bdbb1e186d35982e4995de4e75c90f06d9c485a1de11bc24b5e6

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

829982cc1319f90eb5cbace3ca5a2e52148ba1da618873156153815d7b983f20.exe

description pid process

Token: SeDebugPrivilege 4116 829982cc1319f90eb5cbace3ca5a2e52148ba1da618873156153815d7b983f20.exe

C:\Users\Admin\AppData\Local\Temp\829982cc1319f90eb5cbace3ca5a2e52148ba1da618873156153815d7b983f20.exe
"C:\Users\Admin\AppData\Local\Temp\829982cc1319f90eb5cbace3ca5a2e52148ba1da618873156153815d7b983f20.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4116-130-0x0000000000970000-0x00000000009BA000-memory.dmp

Filesize
296KB

Download
memory/4116-131-0x00007FF87E5D0000-0x00007FF87F091000-memory.dmp

Filesize
10.8MB

Download