ab9ca095a67588bf3dd26d2531b38cc5d5a2837ffc1b08859bf31538a414362e

Analysis

max time kernel
151s
max time network
154s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19-10-2022 10:48

Target

TXAUCYB.EXE.exe
Size

21KB
MD5

e2a5f92b1a73e9637e035d65cfc44e51
SHA1

7c27fd80421f732ab36c583c0fb709703da48c52
SHA256

ab9ca095a67588bf3dd26d2531b38cc5d5a2837ffc1b08859bf31538a414362e
SHA512

ec7fbd159fa3638fc5b1b828c84185b93ddb3c7c7c589c3a65054a57a868e1f6c552f0455cd67dc7e70f0076ba904e19a2aa23ecf3260a1921bb3d326cf23d81
SSDEEP

384:PZcW7LjumpBLqQFtXBMh2+DGi0mZqNewLrKcC/kXjRqmxWE4OB/uc2v42A:bfqQFtY2G4mIewLCsXjwmxWtOB/ucCA

Score

6^/10

discovery

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1340	TXAUCYB.EXE.exe

C:\Users\Admin\AppData\Local\Temp\TXAUCYB.EXE.exe
"C:\Users\Admin\AppData\Local\Temp\TXAUCYB.EXE.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1340

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1340-54-0x00000000011E0000-0x00000000011EC000-memory.dmp

Filesize
48KB

Download
memory/1340-55-0x00000000758B1000-0x00000000758B3000-memory.dmp

Filesize
8KB

Download