2aad22bee9e2bb4ef6370fde5e0a43b06e541235e314b5a4a52dfb8357d477c3

Analysis

max time kernel
151s
max time network
154s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
31-10-2022 07:59

Target

hesaphareketi-01.exe
Size

25KB
MD5

aef764d141280332ade9518ffdcdcb98
SHA1

65d4f7cfcd3732a45312aa38e112513ef63a4c1f
SHA256

2aad22bee9e2bb4ef6370fde5e0a43b06e541235e314b5a4a52dfb8357d477c3
SHA512

802f9a05a2e39863a6ddf8e1f0eabdf4c7ccd2c94d52a08fac24e7a60721d95400801ed31eb72fcb6e2bd75981a797e67ce9ef84950ea65a02e8ce3a58662c70
SSDEEP

384:70EWl++F6Lv9OecKbgQBSsMcptYcFmVc03K:evsVvEsMotYcFmVc6K

Score

6^/10

discovery

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1380	hesaphareketi-01.exe

C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.exe
"C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1380

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1380-54-0x00000000003C0000-0x00000000003CC000-memory.dmp

Filesize
48KB

Download
memory/1380-55-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download