519049c140f5a4f0d6d2115f921d105b1bd4bf46f2e9f66a45762ba5c9cda9e0

Analysis

max time kernel
151s
max time network
155s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-08-2022 10:45

Target

SecuriteInfo.com.W32.AIDetectNet.01.4201.exe
Size

31KB
MD5

993af3de9afbbf18492a7624dc1520d0
SHA1

ffbbb6e36177177f00641f248e0a597d14d5a860
SHA256

519049c140f5a4f0d6d2115f921d105b1bd4bf46f2e9f66a45762ba5c9cda9e0
SHA512

c59274fce6b8a066a6b38988dd159ef09d964bdce7457f18da481e21a70bffa636411b5e386abf23c27c5a494d5a7bbe1ec4a0548f6f22977d59b682632b285a
SSDEEP

768:6XaPBXOLr3u9Ngw1MYwVL6nXfelWhl9lqSg6KJY6Zy:6XaJ+ZkMP6nXcWhl9lqS3Kfy

Score

6^/10

discovery

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1772	SecuriteInfo.com.W32.AIDetectNet.01.4201.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.4201.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.4201.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1772

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1772-54-0x0000000000F20000-0x0000000000F2E000-memory.dmp

Filesize
56KB

Download
memory/1772-55-0x0000000075631000-0x0000000075633000-memory.dmp

Filesize
8KB

Download