fb636076a52142a4d28dc7dd07f4163a38a8ff6f3e205ed60c25317882b307e3 | Triage

Analysis

max time kernel
143s
max time network
149s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
21-07-2022 17:01

Sharing

Report Analysis Logs

General

Target

9ca474dfa5f9f967f313b8eedc8c21f1.exe
Size

1.3MB
MD5

9ca474dfa5f9f967f313b8eedc8c21f1
SHA1

fe34d8e8f8135b751bec2f050be08befc0d86a9e
SHA256

fb636076a52142a4d28dc7dd07f4163a38a8ff6f3e205ed60c25317882b307e3
SHA512

e4bb11ce018a608a4f163249fb253ce8f504a6dbaf064652e997d64f49b02d2a8c97dc7ff479fa40a3f5c147a198916c69bb46e56f9eec09b52ea4ae98a2f14b

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

9ca474dfa5f9f967f313b8eedc8c21f1.exe

description pid process

Token: SeDebugPrivilege 1976 9ca474dfa5f9f967f313b8eedc8c21f1.exe

C:\Users\Admin\AppData\Local\Temp\9ca474dfa5f9f967f313b8eedc8c21f1.exe
"C:\Users\Admin\AppData\Local\Temp\9ca474dfa5f9f967f313b8eedc8c21f1.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1976-54-0x0000000001200000-0x000000000134E000-memory.dmp

Filesize
1.3MB

Download
memory/1976-55-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download