c65e683e60d9f54d5071475e20037fc26bdd16e0e29485af18f259449435827f | Triage

Analysis

max time kernel
141s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
01/08/2023, 02:41

Sharing

Report Analysis Logs

General

Target

ConsoleApplication1.exe
Size

12KB
MD5

77e28972479ae16519d1a80ede19d1ea
SHA1

70672d0c61fc8ec9a1e6c941ff27798d0c2ccb02
SHA256

c65e683e60d9f54d5071475e20037fc26bdd16e0e29485af18f259449435827f
SHA512

d402cd381072af725175da6a3b0f83453988977db3754a50576ff8b3f7ea78a8d3db122f6e87572c4881e9f35c66a062609c4ba5eb35cdc5e25710d657acd0b8
SSDEEP

192:VggXseQv57weeNcexslMs7f6ARse3Q5tfwcHI:KQQv573y6hb6ARP3m

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3916 created 628	3916	ConsoleApplication1.exe	5

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3916	ConsoleApplication1.exe
3916	ConsoleApplication1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3916	ConsoleApplication1.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3916 wrote to memory of 2344	3916	ConsoleApplication1.exe	84
PID 3916 wrote to memory of 2344	3916	ConsoleApplication1.exe	84

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:628
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  PID:2344

C:\Users\Admin\AppData\Local\Temp\ConsoleApplication1.exe
"C:\Users\Admin\AppData\Local\Temp\ConsoleApplication1.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads