87b4cdbfadddf0fb3f57f6d70aae952c2e44f1d426f56ace2ac3447d10303d92

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-08-2022 13:43

Target

New Inquiry.exe
Size

32KB
MD5

4c80af75e8d9ff6e21153417e57d2874
SHA1

665df68d4bad5d33cc0591ceedd6af500e1baa77
SHA256

87b4cdbfadddf0fb3f57f6d70aae952c2e44f1d426f56ace2ac3447d10303d92
SHA512

606ab2a04fd8730e0b447d7500c1fc5f352b663e5c43eade03f42109dddee61fd9749535d421c9b79552ca7e2cf1addaff4f6ae76dc9f58860242694f712a1c7
SSDEEP

768:w2/ipdSl4AAqxDKwGguTLqTDO5XNVZZb9W+:woipLguTLqvO5Xn9W+

Score

9^/10

discovery

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1708	New Inquiry.exe

C:\Users\Admin\AppData\Local\Temp\New Inquiry.exe
"C:\Users\Admin\AppData\Local\Temp\New Inquiry.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1708

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1708-54-0x0000000000940000-0x000000000094E000-memory.dmp

Filesize
56KB

Download
memory/1708-55-0x0000000075D91000-0x0000000075D93000-memory.dmp

Filesize
8KB

Download