86c12a0ecd9361e829b668493544c3f5e3b0feb7e20989e4db283b2138529dc4

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
09-11-2022 14:32

Target

Inquiry_110922.exe
Size

181KB
MD5

dcaa23ff8b67e9603f1f076c16c69dc4
SHA1

a5fee6efc8b5d1bb426f5171a118fadeea44db4f
SHA256

86c12a0ecd9361e829b668493544c3f5e3b0feb7e20989e4db283b2138529dc4
SHA512

5f07e68c0f6e187980f44c5efcd42b4a33c11707d5e0aa432b93c4a583df36e25a54264cdeaae22e7999cfcecba2adda969a6195a7ee4340b0cc9888520f69ce
SSDEEP

768:BmhNJS/lozmCBLx7NnByW/vyvFC586HRLdi5DvXr3NZbs8Q:SDS/+ZBlZBVvMIy6HRUBb3NG8Q

Score

6^/10

discovery

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1048	Inquiry_110922.exe

C:\Users\Admin\AppData\Local\Temp\Inquiry_110922.exe
"C:\Users\Admin\AppData\Local\Temp\Inquiry_110922.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1048

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1048-54-0x0000000000BB0000-0x0000000000BE2000-memory.dmp

Filesize
200KB

Download
memory/1048-55-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download