f6fe8be101673d1d50154bee3058e8369b476aef3087e4ab33d306f0ef02c384

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
11-08-2022 19:05

Target

Proof_Of_Payment.exe
Size

9KB
MD5

31b0e183c76c3abca004ca61889690b2
SHA1

65f30d8010385d7062eca3269d8c52fc9fcc2e09
SHA256

4947ed5a393e7e294356cc60e17ce523b05ffc7774c1cd4bac128a0b83ecec22
SHA512

314f614e825eed5a24fc3a7d21047d3223902c7ca136b1c61a7d9062093ff69147979eaf1406b0ebe709deba4926e19aecb6900659fa3371b28b35cfc3a095dc

Score

6^/10

discovery

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1848	Proof_Of_Payment.exe

C:\Users\Admin\AppData\Local\Temp\Proof_Of_Payment.exe
"C:\Users\Admin\AppData\Local\Temp\Proof_Of_Payment.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1848

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1848-54-0x00000000009E0000-0x00000000009E8000-memory.dmp

Filesize
32KB

Download
memory/1848-55-0x0000000074F41000-0x0000000074F43000-memory.dmp

Filesize
8KB

Download