1c0d0b7350789ac3cd3aaac71175646d9f06f9240689be3b62293e94ffc12658

Analysis

max time kernel
151s
max time network
155s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-08-2022 19:06

Target

hesaphareketi.exe
Size

242KB
MD5

c66347958b1a61cfdebb3c9e9b97f0be
SHA1

aedef9e586da499418f10f9e440633df8331c0d1
SHA256

1c0d0b7350789ac3cd3aaac71175646d9f06f9240689be3b62293e94ffc12658
SHA512

06574dcb091764a7c69125c72b3d1d8512ccfc5bea092fd7d7fd10acebbad061fae6bfa20aa04b40afc84b6cb3505505b2029515415d65e28efb302d796ccdef
SSDEEP

3072:bSyxlHtVN9yzH+T6gqPPIvuvHQFpaIYkKEPIFJzE17vtE:bhVs159HsaIYkb

Score

6^/10

discovery

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1820	hesaphareketi.exe

C:\Users\Admin\AppData\Local\Temp\hesaphareketi.exe
"C:\Users\Admin\AppData\Local\Temp\hesaphareketi.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1820

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1820-54-0x0000000000FA0000-0x0000000000FE4000-memory.dmp

Filesize
272KB

Download
memory/1820-55-0x0000000075061000-0x0000000075063000-memory.dmp

Filesize
8KB

Download