a858b2b8b4be7cb23e0a7d37a0c08489a6820cb1be5523a7a466014eb994391f | Triage

Analysis

max time kernel
154s
max time network
166s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
31-03-2023 16:01

Sharing

Report Analysis Logs

General

Target

$RECYCLE.BIN/$R7M8AKV.scr
Size

180KB
MD5

c80e8eac4376b250584da075ba90d8a8
SHA1

d9078f0a1264d9aa95027a5564a1f193e0e4401d
SHA256

144cc8d0b542290d38b475f126cc78ea9843b0e760226d307e89f857219167c4
SHA512

b41553b0f5baf2b20f6b9e3164666aba9377dd28557954c475b84c479365faa7449b09a3448b7f881c35609b34a61af84299412d7222619d6194425bbe3343bc
SSDEEP

1536:4xk51s+W+yEReHiB0dJoVssssssswksck930mlS4:4xk5DyTHiB0dJoVssssssswks5hS4

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

$R7M8AKV.scr

description pid process

Token: SeDebugPrivilege 2016 $R7M8AKV.scr

C:\Users\Admin\AppData\Local\Temp\$RECYCLE.BIN\$R7M8AKV.scr
"C:\Users\Admin\AppData\Local\Temp\$RECYCLE.BIN\$R7M8AKV.scr" /S
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2016-54-0x0000000000170000-0x00000000001A2000-memory.dmp

Filesize
200KB

Download
memory/2016-55-0x0000000002000000-0x0000000002040000-memory.dmp

Filesize
256KB

Download
memory/2016-56-0x0000000002000000-0x0000000002040000-memory.dmp

Filesize
256KB

Download