Overview

overview

6

Static

static

1

f80fb68e43...c7.exe

windows7-x64

1

f80fb68e43...c7.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    31s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    08/03/2023, 12:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    f80fb68e43d64a69a23431326bd80179f0f3631962ab9ecc8ebb0e0354d105c7.exe

  • Size

    62KB

  • MD5

    f99422c66a010e0d293cc62ea636560c

  • SHA1

    195f2ce63f7d4aaf62d62fa85de027df10c28e7b

  • SHA256

    f80fb68e43d64a69a23431326bd80179f0f3631962ab9ecc8ebb0e0354d105c7

  • SHA512

    8f44b6b4893a1f35ccf1aa15411dbd7720d22b39e43576f71538e34fc21b1b866fa083940865bc541f5e6851332f0e929070bf3dd31ff68f4c19fc8a24dc3fef

  • SSDEEP

    768:cDVW5uhmv9//zzggwyx9rIrQwJYGMbAJAmQvmbAOjPQZIuySRAN:mks89DzKyrzwDMbAqbmMOjPE7m

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f80fb68e43d64a69a23431326bd80179f0f3631962ab9ecc8ebb0e0354d105c7.exe
    "C:\Users\Admin\AppData\Local\Temp\f80fb68e43d64a69a23431326bd80179f0f3631962ab9ecc8ebb0e0354d105c7.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1304

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1304-54-0x00000000011C0000-0x00000000011D6000-memory.dmp

          Filesize

          88KB

          Download

        • memory/1304-55-0x0000000000310000-0x0000000000316000-memory.dmp

          Filesize

          24KB

          Download

        • memory/1304-56-0x0000000000C00000-0x0000000000C40000-memory.dmp

          Filesize

          256KB

          Download