c4d91faa43fba5722a70d24bfae8c4156739a6a1a618a015c298db8436f5cf3e | Triage

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
27-07-2022 20:07

Sharing

Report Analysis Logs

General

Target

bDJ8.exe
Size

36KB
MD5

c0b389e125d888b7bca8dcd4ea25c1bf
SHA1

b58b899489e969e7cb6e0e471f47df80b62dcfc3
SHA256

c4d91faa43fba5722a70d24bfae8c4156739a6a1a618a015c298db8436f5cf3e
SHA512

294037a8eafc91403d9cc8536a76eee590c585647ab2b6af54b7d63a03f9e7420997a0d76b14824745275305f14b615c4c8d7879eb60669f8121c846dbd00000

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

bDJ8.exe

description pid process

Token: SeDebugPrivilege 3924 bDJ8.exe

C:\Users\Admin\AppData\Local\Temp\bDJ8.exe
"C:\Users\Admin\AppData\Local\Temp\bDJ8.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3924-130-0x00007FFE18B50000-0x00007FFE19586000-memory.dmp

Filesize
10.2MB

Download