Analysis

  • max time kernel
    50s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20230621-en
  • resource tags

    arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
  • submitted
    30/06/2023, 10:48

General

  • Target

    千讯网络网盘下载软件19.7.exe

  • Size

    14.1MB

  • MD5

    32692b270cec06019accdc8431cca66e

  • SHA1

    a29a923401439a9ecd6e85084b04bcdc40183fca

  • SHA256

    40ec77207e128e275a86a3b99d7ff4660e914949c17beb13679b6a02ba216fc1

  • SHA512

    eb2547aa11dc81d23ffb448cf39d083d4c158e271dbb451868e6e983c7a7fb3ca640b9416ced526d8cf26fc2401c0c25c43fe7a30802cf81ffda983cde5f41d2

  • SSDEEP

    98304:aKCdC667FJhRAkdNLbU899Z2fpI2FpYEk+/qzZnBq5wkp+wZ3ZITRF/yzujL:aK8C6ahRAu99Z2BZY9+w7qqgZZIDqzY

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\千讯网络网盘下载软件19.7.exe
    "C:\Users\Admin\AppData\Local\Temp\千讯网络网盘下载软件19.7.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1204-54-0x0000000001680000-0x00000000016C0000-memory.dmp

    Filesize

    256KB

  • memory/1204-55-0x0000000001110000-0x0000000001111000-memory.dmp

    Filesize

    4KB

  • memory/1204-56-0x0000000001680000-0x00000000016C0000-memory.dmp

    Filesize

    256KB

  • memory/1204-57-0x0000000001680000-0x00000000016C0000-memory.dmp

    Filesize

    256KB

  • memory/1204-58-0x0000000001680000-0x00000000016C0000-memory.dmp

    Filesize

    256KB

  • memory/1204-59-0x0000000001680000-0x00000000016C0000-memory.dmp

    Filesize

    256KB

  • memory/1204-60-0x0000000001680000-0x00000000016C0000-memory.dmp

    Filesize

    256KB