701e71b008f60ce7169b9ca046cf12ed79ff47942ac2443eeab1751b3f169fca | Triage

Analysis

max time kernel
39s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 19:54

Sharing

Report Analysis Logs

General

Target

file.exe
Size

7.9MB
MD5

63cc611c54ebf90806061d94dfb7e1a8
SHA1

d70382bb56bdf63ff19ac01c8c25800467198938
SHA256

701e71b008f60ce7169b9ca046cf12ed79ff47942ac2443eeab1751b3f169fca
SHA512

f3aa77a78dcf295fc259cffbd31625c3f0deb2a270a94a4bd6a6da4922201a4d30c304a15e6703f5a61ad49390060d54e68210cb2431c497738bc44572909a9f
SSDEEP

49152:WLJq4qjSk3nx+bnFOlsdBg/0C8vJrdw9ZoEan:WLJq4qjSk3nx+bnp4/+vEan

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

file.exe

pid process

2020 file.exe
2020 file.exe
2020 file.exe
2020 file.exe
2020 file.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

file.exe

pid process

2020 file.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

file.exe

description pid process

Token: SeDebugPrivilege 2020 file.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2020

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2020-54-0x0000000000B80000-0x0000000001376000-memory.dmp

Filesize
8.0MB

Download