589f1243dd7b412cb6880c0681905c064fbc05c16e078edba63c6ce32da31848 | Triage

Analysis

max time kernel
91s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 16:32

Sharing

Report Analysis Logs

General

Target

WPE/W-P-E.exe
Size

951KB
MD5

de2728f4917c8ef287f1cc0b9f4d1ac7
SHA1

07a511fffc8081eb87076529f84a48572e874315
SHA256

55c93531a44b6f6b68ae0fdf73a95f074f86b47bd66b40b351a3da04f59e0b10
SHA512

71bab7f145a688ae882185bd3e491ac3e90ad75253ba4f20bf6c1016bf63a0f46320bf486e35bdcbff7d3d0d49c6f46d1b9383bdbebc632d4ebee6cf9326d81c
SSDEEP

12288:e3v6sgx8iIivBmxWb30XJe4s1lPSOCx8zmRaar5kuHer2zHjaJsg1zvG:e/6tIu3Ujs1VDCx3GuDU1C

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

W-P-E.exe

description pid process

Token: SeDebugPrivilege 2672 W-P-E.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

W-P-E.exe

pid process

2672 W-P-E.exe
2672 W-P-E.exe
2672 W-P-E.exe
2672 W-P-E.exe

C:\Users\Admin\AppData\Local\Temp\WPE\W-P-E.exe
"C:\Users\Admin\AppData\Local\Temp\WPE\W-P-E.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2672-132-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download
memory/2672-153-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download