3be69750b64f87e18bcd6d779fbc9511f17e57b8c7738d9374e262fb377ff56a

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
08-09-2022 12:33

Target

PO No. 27485758.exe
Size

228KB
MD5

47607a1861b00bcf044d136eadee4ab9
SHA1

a8879f81f8547d46930f0cd4ce338cf8af54232e
SHA256

3be69750b64f87e18bcd6d779fbc9511f17e57b8c7738d9374e262fb377ff56a
SHA512

486c4e12ec2f4cf27782e73c433a62f15e6021db2e890e94161a61a2bf591897cec8ce56bd162488bf5de1b676dc69e7ee104f8b27fde2a9126ca024a9266e1a
SSDEEP

3072:x+T6gqPPIvuvHQFpaIYkKEPIFJzE17vtx:n59HsaIYkb

Score

9^/10

discovery

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	832	PO No. 27485758.exe

C:\Users\Admin\AppData\Local\Temp\PO No. 27485758.exe
"C:\Users\Admin\AppData\Local\Temp\PO No. 27485758.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:832

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/832-54-0x0000000000E50000-0x0000000000E8E000-memory.dmp

Filesize
248KB

Download
memory/832-55-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download