9c4b4f7a530bbef4d4b00126efac07c315127ed16cdb710b698bb3788780617e | Triage

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
01-03-2023 09:00

Sharing

Report Analysis Logs

General

Target

tmp.exe
Size

86KB
MD5

6c13cfa37c442520c5a0f923aa93f1cb
SHA1

86f926f052a66b300272c18846802cc56c5a1700
SHA256

9c4b4f7a530bbef4d4b00126efac07c315127ed16cdb710b698bb3788780617e
SHA512

7461d86002fa961f25b7b3841601088f7f19af6f14de10932e22d0aeef529181caafbde79e877f8c482bbafe984a08d6a849cd2241f3db87062c42d561ec1dd6
SSDEEP

1536:yDTOlmyW5XXrtxfyZ7V9N4INCxVnA2rbxM3pf7IO6CFQ0:uyqnbE7PWvy64

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

tmp.exe

pid process

1692 tmp.exe
1692 tmp.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

tmp.exe

description pid process

Token: SeDebugPrivilege 1692 tmp.exe
Token: SeDebugPrivilege 1692 tmp.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1692-54-0x00000000002A0000-0x00000000002CD000-memory.dmp

Filesize
180KB

Download