f62b32d3099723ae24346cc161986e47a2af2ae1e59729bbab54ecba6fb13cd5 | Triage

Analysis

max time kernel
484s
max time network
492s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2023, 18:12

Sharing

Report Analysis Logs

General

Target

yak.exe
Size

58.2MB
MD5

fa5b95f30e07c3df67ff8f137bdad7f6
SHA1

bfd147bac8cc066280b9fa83088f7786518c1e7e
SHA256

f62b32d3099723ae24346cc161986e47a2af2ae1e59729bbab54ecba6fb13cd5
SHA512

b4771dca7936fd2cbf778f9bba0b13b5bfe189902fcc436c90e8401b5530069d9111cb953437a64ae9d457d3526c2b817b0041d3b609e6c663d5b63c0b0c5380
SSDEEP

393216:E9wQ3nEG3gMgKejPKz1+n15QHV6jzy7EqchRgL:wN3nEQgMgKeTKz1+n1mHyz/Rg

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4640	yak.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 2936	4640	yak.exe	86
PID 4640 wrote to memory of 2936	4640	yak.exe	86
PID 4640 wrote to memory of 3372	4640	yak.exe	87
PID 4640 wrote to memory of 3372	4640	yak.exe	87

C:\Users\Admin\AppData\Local\Temp\yak.exe
"C:\Users\Admin\AppData\Local\Temp\yak.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Windows\system32\cmd.exe
  cmd ver
  2⤵
  PID:2936
- C:\Windows\system32\arp.exe
  arp -a
  2⤵
  PID:3372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4640-133-0x00000000001D0000-0x00000000043B8000-memory.dmp

Filesize
65.9MB

Download