f62b32d3099723ae24346cc161986e47a2af2ae1e59729bbab54ecba6fb13cd5 | Triage

Analysis

max time kernel
391s
max time network
399s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
09/05/2023, 18:12

Sharing

Report Analysis Logs

General

Target

yak.exe
Size

58.2MB
MD5

fa5b95f30e07c3df67ff8f137bdad7f6
SHA1

bfd147bac8cc066280b9fa83088f7786518c1e7e
SHA256

f62b32d3099723ae24346cc161986e47a2af2ae1e59729bbab54ecba6fb13cd5
SHA512

b4771dca7936fd2cbf778f9bba0b13b5bfe189902fcc436c90e8401b5530069d9111cb953437a64ae9d457d3526c2b817b0041d3b609e6c663d5b63c0b0c5380
SSDEEP

393216:E9wQ3nEG3gMgKejPKz1+n15QHV6jzy7EqchRgL:wN3nEQgMgKeTKz1+n1mHyz/Rg

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2044	yak.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 1048	2044	yak.exe	29
PID 2044 wrote to memory of 1048	2044	yak.exe	29
PID 2044 wrote to memory of 1048	2044	yak.exe	29
PID 2044 wrote to memory of 1932	2044	yak.exe	30
PID 2044 wrote to memory of 1932	2044	yak.exe	30
PID 2044 wrote to memory of 1932	2044	yak.exe	30

C:\Users\Admin\AppData\Local\Temp\yak.exe
"C:\Users\Admin\AppData\Local\Temp\yak.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\system32\cmd.exe
  cmd ver
  2⤵
  PID:1048
- C:\Windows\system32\arp.exe
  arp -a
  2⤵
  PID:1932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2044-54-0x0000000000BE0000-0x0000000004DC8000-memory.dmp

Filesize
65.9MB

Download