8367c91c8ad10fe8de7b166c9644fab7c577ba68f79c6ebfde9e6d8f3f917d6b | Triage

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
18-02-2023 11:37

Sharing

Report Analysis Logs

General

Target

Application(1).exe
Size

87KB
MD5

940ab9fc18380a00dd82e1c6328fa92f
SHA1

dfe975d50d5c190c0666332740b3ed2747e9eaf6
SHA256

8367c91c8ad10fe8de7b166c9644fab7c577ba68f79c6ebfde9e6d8f3f917d6b
SHA512

bf3db349476bcafada7e9f7fd0a7bee19b6e3e089e90c87beedabc65e7c96006f2091625d87ec5d5337a4475d05f046ef24b4397911f71110921d04df962a433
SSDEEP

768:C+xm1/oTOiAWVG5xTbPrzhOH6c3RWmYOawWPvUDwReffsff0n:OFmJAWVehOH6c3RWVOlYeffsff

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Application(1).exe

pid process

1728 Application(1).exe
1728 Application(1).exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Application(1).exe

description pid process

Token: SeDebugPrivilege 1728 Application(1).exe
Token: SeDebugPrivilege 1728 Application(1).exe

C:\Users\Admin\AppData\Local\Temp\Application(1).exe
"C:\Users\Admin\AppData\Local\Temp\Application(1).exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1728

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1728-54-0x00000000003F0000-0x000000000041E000-memory.dmp

Filesize
184KB

Download