59bb48f0b7c22078a26b576626ec46e25f0b210588fa76a7346bef6c7063b3db | Triage

Analysis

max time kernel
146s
max time network
153s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
17-08-2022 08:10

Sharing

Report Analysis Logs

General

Target

tmp.exe
Size

3.8MB
MD5

0145183162d6e88d69a427968845e789
SHA1

b706f144c557fb0f47df51f4b826a9991c6c1833
SHA256

59bb48f0b7c22078a26b576626ec46e25f0b210588fa76a7346bef6c7063b3db
SHA512

83473e3b4dc0e63ddc674e545515de15feca324674672aeee892ba31a224fd2d8fa255d9ac9a2bf04a4571d08ceed83c428dba75f48c84bbd674a96c8adadb6b

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

tmp.exe

pid process

1208 tmp.exe
1208 tmp.exe
1208 tmp.exe
1208 tmp.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

tmp.exe

description pid process

Token: SeDebugPrivilege 1208 tmp.exe
Token: SeShutdownPrivilege 1208 tmp.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

tmp.exe

pid process

1208 tmp.exe
1208 tmp.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1208-54-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download