Analysis

  • max time kernel
    191s
  • max time network
    223s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    03/12/2022, 23:39

General

  • Target

    af479ab2571ae3a6d7a087296a8fdbb059a74fd3d83851e562004068cfa62f94.exe

  • Size

    58KB

  • MD5

    a10b5d474c7f4d3fcbd32c83e239f618

  • SHA1

    fe8da2ffdab2d7cc388ec984be9914dd02aed4a7

  • SHA256

    af479ab2571ae3a6d7a087296a8fdbb059a74fd3d83851e562004068cfa62f94

  • SHA512

    95d07c9e3748042826222cbb7e1339febcdad2fe129a6d19d12aa1022b44dc68b567f0cfd4db0135133cc0137ad1827eece34023539f506d3c109aaec8f75557

  • SSDEEP

    1536:N1Dsy6cwHqNSLAWSuIJMd7b4frJKYQrp:HSqYUIIKR4frJKYQt

Score
8/10
upx

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\af479ab2571ae3a6d7a087296a8fdbb059a74fd3d83851e562004068cfa62f94.exe
    "C:\Users\Admin\AppData\Local\Temp\af479ab2571ae3a6d7a087296a8fdbb059a74fd3d83851e562004068cfa62f94.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1392-54-0x0000000075BE1000-0x0000000075BE3000-memory.dmp

    Filesize

    8KB

  • memory/1392-55-0x0000000010000000-0x0000000010028000-memory.dmp

    Filesize

    160KB