74014d74f082c5194575c51338f0271aa24b18c14e6efed2d7028874a35523d8 | Triage

Analysis

max time kernel
46s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02-10-2022 20:04

Sharing

Report Analysis Logs

General

Target

MainModule.exe
Size

71KB
MD5

f3409fcd8c8f4b6f45784901b512cd67
SHA1

cad63d6dfde55cf80f8a717be9c95ad0aaa2ed43
SHA256

74014d74f082c5194575c51338f0271aa24b18c14e6efed2d7028874a35523d8
SHA512

27c39f10aa902ccc06fbbd635e4a747e0ba7e653f08a736e9ce2564e61392ebba43551a2718ab3366d713e86fdcf182dd2ba03335dfa54f7fa27009d216aad7d
SSDEEP

1536:xGhlUqvzB/7uw81RpPbYAnbOWMmAuPqIv:xSuqbB/7uw81RpPbYAnbOWMmN

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

MainModule.exe

pid process

1768 MainModule.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MainModule.exe

description pid process

Token: SeDebugPrivilege 1768 MainModule.exe

C:\Users\Admin\AppData\Local\Temp\MainModule.exe
"C:\Users\Admin\AppData\Local\Temp\MainModule.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1768

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1768-54-0x0000000000130000-0x0000000000148000-memory.dmp

Filesize
96KB

Download
memory/1768-55-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/1768-56-0x0000000076961000-0x0000000076963000-memory.dmp

Filesize
8KB

Download