67dc36b32a718de5d05b8ccf59d8a0415a76c8c42729065145f7f9da83726b7b

Analysis

max time kernel
151s
max time network
154s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
22-09-2022 20:37

Target

Radicado generado relacionado F.-0932 Sept 2022.exe
Size

1.2MB
MD5

3a1799dc19d575bd7abc03d3bdf2afd3
SHA1

250d8cb56c9307c5a5a3bb99ce0d1388b59a98a5
SHA256

67dc36b32a718de5d05b8ccf59d8a0415a76c8c42729065145f7f9da83726b7b
SHA512

e9528f32505f8d7094c84e24bcf5d5de462cf7b662babede5f6e8608b1f6f000e218fe15311e520c9c4cbebc0f87d012abcf38d3e297495fef48d7a721ba3064
SSDEEP

24576:647pJG5oP7wIS93chQu4u4QqXMAUfO51QVRRV9F+cQO:N7pJSQ7wIS+h34nXT7gL9+5O

Score

9^/10

discovery

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Radicado generado relacionado F.-0932 Sept 2022.exe

description pid process

Token: SeDebugPrivilege 1256 Radicado generado relacionado F.-0932 Sept 2022.exe

description	pid	process
Token: SeDebugPrivilege	1256	Radicado generado relacionado F.-0932 Sept 2022.exe

C:\Users\Admin\AppData\Local\Temp\Radicado generado relacionado F.-0932 Sept 2022.exe
"C:\Users\Admin\AppData\Local\Temp\Radicado generado relacionado F.-0932 Sept 2022.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1256

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1256-54-0x0000000000330000-0x000000000045A000-memory.dmp

Filesize
1.2MB

Download
memory/1256-55-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download