9fda1a2ea2cfa0071a31e28b143f24e9bd6798542644ebba6e80bbc6976e6f4d | Triage

Analysis

max time kernel
23s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 05:20

Sharing

Report Analysis Logs

General

Target

ͬ/ͬ.exe
Size

394KB
MD5

f040b1e0b505401313ab6c79a8ee407f
SHA1

fe03c35c1a78d52a8f4e4a94f02150ae06488679
SHA256

77e00941c6cc39eaecdc3b8caa60cfc3e1ad4c189a618b517f3b1279fc00f032
SHA512

fc1ba6a484f89585a1849ff2f2398cf3312321fe12556940b9a7a61a3e853abcded55925849e89254c05ecf6338baa273434231051f0d7e404706c0ea17c37af
SSDEEP

12288:/df6PAxAF7iAn84oem+KmxHKRMczRsn3SbIoS:VyYSF7ip4LtKmxH/ki3Sb

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral3/memory/1784-55-0x0000000000400000-0x000000000050D000-memory.dmp	upx
behavioral3/memory/1784-56-0x0000000000400000-0x000000000050D000-memory.dmp	upx

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1784	ͬ.exe
Token: SeDebugPrivilege	1784	ͬ.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1784	ͬ.exe
1784	ͬ.exe

C:\Users\Admin\AppData\Local\Temp\ͬ\ͬ.exe
"C:\Users\Admin\AppData\Local\Temp\ͬ\ͬ.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1784-54-0x00000000767F1000-0x00000000767F3000-memory.dmp

Filesize
8KB

Download
memory/1784-55-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/1784-56-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download