191af06b64af5a66982aaede62467c05ff5f31ff85545aa8de753ded9e0f8c97

Analysis

max time kernel
157s
max time network
166s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
22-10-2022 12:41

Target

hesaphareketi-01.exe
Size

95KB
MD5

ced49c7ea69c25463fc4b7e346cb1adc
SHA1

4fc86081fee8ec4198e279dbe9e1707003c22b21
SHA256

191af06b64af5a66982aaede62467c05ff5f31ff85545aa8de753ded9e0f8c97
SHA512

31beffda865e8973b9980fd3bf1d163076c8ee6463aada1c2287d54cdf9d230b6d28e1aa60e97a5fdb8d22aa004cdbffd034a038c22873bb1d6b3f28683939f1
SSDEEP

384:n02vN0lc0WYHZUI7WYLyLy10EyR9ZP4L2x+ZB:pl0l957UE5B

Score

9^/10

discovery

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1476	hesaphareketi-01.exe

C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.exe
"C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1476

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1476-54-0x00000000013A0000-0x00000000013BE000-memory.dmp

Filesize
120KB

Download
memory/1476-55-0x0000000074C11000-0x0000000074C13000-memory.dmp

Filesize
8KB

Download