45c871fa970cb78e5c1832eb19201659c3961a1c688697774ee947ad70dbc2a7 | Triage

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-09-2022 02:49

Sharing

Report Analysis Logs

General

Target

b91fb7bbef1fe38b4f9e2b4315dc018c.exe
Size

6KB
MD5

b91fb7bbef1fe38b4f9e2b4315dc018c
SHA1

17670f20a892713eee445c1d46f450765ca58e7f
SHA256

45c871fa970cb78e5c1832eb19201659c3961a1c688697774ee947ad70dbc2a7
SHA512

2a67653cc76578bd917216d72550bdff58d86be4ccf58af88d95f4e9144b9d238f741ef7846597440c091cc9c9eea20a55532f7a375891b375afc60060d2b194
SSDEEP

96:Ei6WXBXvOLseWYdY4ZY/8J6clhu96BzNt:Ei6EBXvOL3xJZY/8J6crA6D

Score

6^/10

discovery

Malware Config

Signatures

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b91fb7bbef1fe38b4f9e2b4315dc018c.exe

description pid process

Token: SeDebugPrivilege 1996 b91fb7bbef1fe38b4f9e2b4315dc018c.exe

C:\Users\Admin\AppData\Local\Temp\b91fb7bbef1fe38b4f9e2b4315dc018c.exe
"C:\Users\Admin\AppData\Local\Temp\b91fb7bbef1fe38b4f9e2b4315dc018c.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1996

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1996-54-0x0000000000C30000-0x0000000000C38000-memory.dmp

Filesize
32KB

Download
memory/1996-55-0x0000000074C11000-0x0000000074C13000-memory.dmp

Filesize
8KB

Download