9258cdc242c0e1759a9de5b0cc9382c8e49fc66d24310485badea6702aa51c5b | Triage

Analysis

max time kernel
152s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 18:54

Sharing

Report Analysis Logs

General

Target

invoice.exe
Size

7KB
MD5

07ea7c18f551e8f176334f4d3c9ebfde
SHA1

b6710870db3b3c8a2b6dc8fe7cb2011fdad33097
SHA256

9258cdc242c0e1759a9de5b0cc9382c8e49fc66d24310485badea6702aa51c5b
SHA512

10746e44a07f0182a584d2f94d7e5cb94a43eb0e518ae8d9dbf83aad71e60e074e2a3460b50dee29afdcf7c47f8d58beea4d77d0e399760cc0394cf13e74a8ff
SSDEEP

96:xFaIzbK0D5SXpDqfTQdyYdlIULBeTXTWBkYPe/kYOpDOskSkYxrZzNt:xFaweh2TQIYdKULBeykY2zOpDO1vKrb

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

invoice.exe

description pid process

Token: SeDebugPrivilege 2148 invoice.exe

C:\Users\Admin\AppData\Local\Temp\invoice.exe
"C:\Users\Admin\AppData\Local\Temp\invoice.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2148

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2148-132-0x0000000000150000-0x0000000000158000-memory.dmp

Filesize
32KB

Download
memory/2148-133-0x00000000051A0000-0x0000000005744000-memory.dmp

Filesize
5.6MB

Download
memory/2148-134-0x0000000004B10000-0x0000000004BA2000-memory.dmp

Filesize
584KB

Download
memory/2148-135-0x0000000004AF0000-0x0000000004AFA000-memory.dmp

Filesize
40KB

Download