e0d5b8485b278b1b74915a2d83bffeeb53e67e309620f9eaeb0f836c01813e05

Analysis

max time kernel
151s
max time network
154s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
22-08-2022 17:45

Target

hesaphareketi-01.exe
Size

89KB
MD5

a393679a29046acea89136e6924c3e19
SHA1

df345f6ee3e546d6d9320dc68482f0cc643ffed5
SHA256

711d00503de479cd6ffd1492e2d42eecd96c9a946c0d6bb088dd37c696a76f00
SHA512

787dccef6355378219f47217850df51c7ac5a72e2a1d3a04426a89bfe2ca32d0be13a2e421b4ab0cd0c95048dc53ffec1c8a95e0a9cd349b33a6818a159042e2

Score

9^/10

discovery

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2020	hesaphareketi-01.exe

C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.exe
"C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2020

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2020-54-0x00000000010B0000-0x00000000010CC000-memory.dmp

Filesize
112KB

Download
memory/2020-55-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download