76ee151db592d2d4fc40090d29377b79edbc33f1445ed63566a7f6892dc0d064 | Triage

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
31-03-2023 01:59

Sharing

Report Analysis Logs

General

Target

file.exe
Size

63KB
MD5

6790f5477fd0f2c8fedba93d7c3a366d
SHA1

51b8c2a24460823c650464f47cf6362b156a732d
SHA256

76ee151db592d2d4fc40090d29377b79edbc33f1445ed63566a7f6892dc0d064
SHA512

bb0222c528aae62d666521bd8b4668de337a6a7de8b58c8f252410695e374f829f82602e839dbb610228db7abfc1b2dc000fd0ba0207cd89418b62546f60b874
SSDEEP

768:fGsKfzI7wLgHFz/tJtSsBaC2x0T7VvgLLSzMbEJskwMj7ttGUAKS0RGRQz:fHGsacFTtSTC2x0gLQMbETZMUbRGI

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

file.exe

pid process

1488 file.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

file.exe

description pid process

Token: SeDebugPrivilege 1488 file.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1488

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1488-54-0x0000000001300000-0x0000000001316000-memory.dmp

Filesize
88KB

Download
memory/1488-55-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/1488-56-0x0000000004AB0000-0x0000000004AF0000-memory.dmp

Filesize
256KB

Download