fc7184971a5ba840942bb701ffd02bad08d55a351adf17a2040d1c68c0a71b3e | Triage

Analysis

max time kernel
147s
max time network
153s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
17/12/2022, 22:38 UTC

Sharing

Report Analysis Logs

General

Target

PO11132201.exe
Size

8KB
MD5

1d668ac0d03b0a28fa7b4fc4494dfc7a
SHA1

2468f7129e87541961450b6cea83eb361f82a621
SHA256

eda2c870c2a97ecc988ac2e1a53f893d83c563fa5b40b3194f9dd8c33e0bb2fa
SHA512

792cd660b67a1e96e02ece24ba61412723f0d5d720d8d53ae6137c4c911471a3bfbb41a8f3ab2b6231e0d9b1b86818fc7c9aef9b01298dded5e7b13801b3ee28
SSDEEP

96:xjwAimGGx2l0v7+4GkTNu+/D10gQvH+0GkSYx0HvHQrFnU:xLT2lSpGkTNRrWg0HhrSY1O

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1376	PO11132201.exe

C:\Users\Admin\AppData\Local\Temp\PO11132201.exe
"C:\Users\Admin\AppData\Local\Temp\PO11132201.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1376

Network

No results found

185.246.220.210:80

PO11132201.exe

152 B
3
185.246.220.210:80

PO11132201.exe

152 B
3
185.246.220.210:80

PO11132201.exe

152 B
3
185.246.220.210:80

PO11132201.exe

152 B
3
185.246.220.210:80

PO11132201.exe

104 B
2

No results found

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1376-54-0x0000000000E70000-0x0000000000E78000-memory.dmp

Filesize
32KB

Download
memory/1376-55-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

Filesize
8KB

Download