b1198208e9e31b019e36fe22edc2e2bbe54641448b5c0dec09b43add73684829 | Triage

Analysis

max time kernel
36s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21/11/2022, 10:45

Sharing

Report Analysis Logs

General

Target

tmp.exe
Size

2.7MB
MD5

3a0cb1e57457a5363e037555b0c198a2
SHA1

bc285f20a0aa3c48d65d8f9ed60f3b059ee08195
SHA256

b1198208e9e31b019e36fe22edc2e2bbe54641448b5c0dec09b43add73684829
SHA512

1555d85579e4d107e4e4f9efa5e9a76f1e9bb8e7bddaf6e54f66262834d79276aa8c752333a20872ae62adcee83aadcab70cd94488feff8cac9044e906c0698f
SSDEEP

24576:eF4fvdjFd9qwnzw1rCw8tvpwfOE3XP/08HNNYxQtNGSYQkxChx4:eadjcwnzwewwOfBXPLNrGSYdxChx

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
1672	tmp.exe
1672	tmp.exe
1672	tmp.exe
1672	tmp.exe
1672	tmp.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1672	tmp.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1672	tmp.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1672-54-0x0000000000F80000-0x0000000001244000-memory.dmp

Filesize
2.8MB

Download