634d152d7405ae0ba2ba47f633f74b8df0436045bf3454affe0b366cb976b4fd

Analysis

max time kernel
43s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 11:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

634d152d7405ae0ba2ba47f633f74b8df0436045bf3454affe0b366cb976b4fd.exe
Size

8.0MB
MD5

7e4469f014970ddfc37e5031b769b2d4
SHA1

af86adcbcc488262cf30512eeb7c310615a7b6ce
SHA256

634d152d7405ae0ba2ba47f633f74b8df0436045bf3454affe0b366cb976b4fd
SHA512

91b8ebf3522b509f2ecb671b49e6d20e1f30cbe03ea219e2416942feb25debf06037ed945ddd81282c9edafedffed03b8e2ed943c7d2a039b5d24912e75bff55
SSDEEP

196608:R4WCxHzeNWQRf8XZdh0785jdXy9XYy/EP+6Eft92G4A41qi1zwT:RJCxTeNHEHh0IGINIftCA4LNwT

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
1696	634d152d7405ae0ba2ba47f633f74b8df0436045bf3454affe0b366cb976b4fd.exe
1696	634d152d7405ae0ba2ba47f633f74b8df0436045bf3454affe0b366cb976b4fd.exe
1696	634d152d7405ae0ba2ba47f633f74b8df0436045bf3454affe0b366cb976b4fd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1696	634d152d7405ae0ba2ba47f633f74b8df0436045bf3454affe0b366cb976b4fd.exe

C:\Users\Admin\AppData\Local\Temp\634d152d7405ae0ba2ba47f633f74b8df0436045bf3454affe0b366cb976b4fd.exe
"C:\Users\Admin\AppData\Local\Temp\634d152d7405ae0ba2ba47f633f74b8df0436045bf3454affe0b366cb976b4fd.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\xpi5rtpl.zgj\7z.dll

Filesize
893KB

MD5
04ad4b80880b32c94be8d0886482c774

SHA1
344faf61c3eb76f4a2fb6452e83ed16c9cce73e0

SHA256
a1e1d1f0fff4fcccfbdfa313f3bdfea4d3dfe2c2d9174a615bbc39a0a6929338

SHA512
3e3aaf01b769471b18126e443a721c9e9a0269e9f5e48d0a10251bc1ee309855bd71ede266caa6828b007359b21ba562c2a5a3469078760f564fb7bd43acabfb

Download Submit
\Users\Admin\AppData\Local\Temp\xpi5rtpl.zgj\7z.dll

Filesize
893KB

MD5
04ad4b80880b32c94be8d0886482c774

SHA1
344faf61c3eb76f4a2fb6452e83ed16c9cce73e0

SHA256
a1e1d1f0fff4fcccfbdfa313f3bdfea4d3dfe2c2d9174a615bbc39a0a6929338

SHA512
3e3aaf01b769471b18126e443a721c9e9a0269e9f5e48d0a10251bc1ee309855bd71ede266caa6828b007359b21ba562c2a5a3469078760f564fb7bd43acabfb

Download Submit
\Users\Admin\AppData\Local\Temp\xpi5rtpl.zgj\7z.dll

Filesize
893KB

MD5
04ad4b80880b32c94be8d0886482c774

SHA1
344faf61c3eb76f4a2fb6452e83ed16c9cce73e0

SHA256
a1e1d1f0fff4fcccfbdfa313f3bdfea4d3dfe2c2d9174a615bbc39a0a6929338

SHA512
3e3aaf01b769471b18126e443a721c9e9a0269e9f5e48d0a10251bc1ee309855bd71ede266caa6828b007359b21ba562c2a5a3469078760f564fb7bd43acabfb

Download Submit
memory/1696-54-0x0000000074E41000-0x0000000074E43000-memory.dmp

Filesize
8KB

Download
memory/1696-55-0x0000000074160000-0x000000007470B000-memory.dmp

Filesize
5.7MB

Download
memory/1696-59-0x00000000002D7000-0x00000000002E8000-memory.dmp

Filesize
68KB

Download
memory/1696-60-0x0000000074160000-0x000000007470B000-memory.dmp

Filesize
5.7MB

Download
memory/1696-61-0x00000000002D7000-0x00000000002E8000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads