bd30b36cf30266e1b4c8f7d8bb082ebbc7b97d42ba36dc5e80f5793bc58f6e42 | Triage

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
15-03-2023 15:52

Sharing

Report Analysis Logs

General

Target

Bark (1).exe
Size

230KB
MD5

f855cb3375f71c3d61e7432e7fb0b185
SHA1

d66995179269fd66c143022f28b371a2ce042c4e
SHA256

bd30b36cf30266e1b4c8f7d8bb082ebbc7b97d42ba36dc5e80f5793bc58f6e42
SHA512

a7a952ea8e9a8af67f6f6ef9ec8aca079745da70b5f118fea44cac0d169238321b05bd6ef889dab6bcc190e47c2114ab61ec4e32a1bd4a87eccb792e803f7141
SSDEEP

6144:sQgJNRlxJyQTjA43Qv2rvgoQRlxJyQTjA43QvV8F3:GJNRlLynLoQRlLynWF

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Bark (1).exe

pid process

1704 Bark (1).exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Bark (1).exe

description pid process

Token: SeDebugPrivilege 1704 Bark (1).exe

C:\Users\Admin\AppData\Local\Temp\Bark (1).exe
"C:\Users\Admin\AppData\Local\Temp\Bark (1).exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1704-54-0x0000000001370000-0x00000000013AC000-memory.dmp

Filesize
240KB

Download
memory/1704-55-0x0000000004B90000-0x0000000004BD0000-memory.dmp

Filesize
256KB

Download
memory/1704-56-0x0000000000480000-0x000000000048A000-memory.dmp

Filesize
40KB

Download
memory/1704-57-0x0000000004B90000-0x0000000004BD0000-memory.dmp

Filesize
256KB

Download