9c4b4f7a530bbef4d4b00126efac07c315127ed16cdb710b698bb3788780617e | Triage

Analysis

max time kernel
92s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
28-02-2023 14:10

Sharing

Report Analysis Logs

General

Target

file.exe
Size

86KB
MD5

6c13cfa37c442520c5a0f923aa93f1cb
SHA1

86f926f052a66b300272c18846802cc56c5a1700
SHA256

9c4b4f7a530bbef4d4b00126efac07c315127ed16cdb710b698bb3788780617e
SHA512

7461d86002fa961f25b7b3841601088f7f19af6f14de10932e22d0aeef529181caafbde79e877f8c482bbafe984a08d6a849cd2241f3db87062c42d561ec1dd6
SSDEEP

1536:yDTOlmyW5XXrtxfyZ7V9N4INCxVnA2rbxM3pf7IO6CFQ0:uyqnbE7PWvy64

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

file.exe

pid process

1172 file.exe
1172 file.exe
1172 file.exe
1172 file.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

file.exe

description pid process

Token: SeDebugPrivilege 1172 file.exe
Token: SeDebugPrivilege 1172 file.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1172-133-0x0000000000410000-0x000000000043D000-memory.dmp

Filesize
180KB

Download
memory/1172-134-0x0000000000410000-0x000000000043D000-memory.dmp

Filesize
180KB

Download