33035a718f5445742b82707f0ba6aff80337cac1e89b6b3b8b51177c7f9f578a | Triage

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
03-04-2023 19:03

Sharing

Report Analysis Logs

General

Target

SystemUpdate.exe
Size

62KB
MD5

09a29f3b529c5e9ab25a47973bb0900a
SHA1

b8dce851d01dbe0335f11fa8449b52a2270776e6
SHA256

33035a718f5445742b82707f0ba6aff80337cac1e89b6b3b8b51177c7f9f578a
SHA512

35e92a26fc392b15eb7fd78ca1f6a6c08afe42ed535fd020237215d7f4db0f66fa0676eb70d646f8790c9724c30c605a99b33cf6a6c84c3de78f6061f1a48efb
SSDEEP

1536:s2JbaiIZApuLzOgkx9MbEze4g3ViceSITKdU:dbahZApuL1kx9MbEze4g3ViceYO

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

SystemUpdate.exe

pid process

1372 SystemUpdate.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

SystemUpdate.exe

description pid process

Token: SeDebugPrivilege 1372 SystemUpdate.exe

C:\Users\Admin\AppData\Local\Temp\SystemUpdate.exe
"C:\Users\Admin\AppData\Local\Temp\SystemUpdate.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1372

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1372-54-0x0000000000AB0000-0x0000000000AC6000-memory.dmp

Filesize
88KB

Download
memory/1372-55-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/1372-56-0x00000000006E0000-0x0000000000720000-memory.dmp

Filesize
256KB

Download