31fcc1a7c79fa0e760d81e479154824551be394658821275380c9fc45343ae22 | Triage

Analysis

max time kernel
23s
max time network
19s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
13-08-2023 18:33

Sharing

Report Analysis Logs

General

Target

ted.exe
Size

496KB
MD5

9699ff0cbc3936fbc5b223db9c442b04
SHA1

6aca03cfda845015eb0026180b6e276e88e0c4ef
SHA256

63830225bc72ebde208448beb37f155e9d4e5c360b0e78185af21f348e651cea
SHA512

33db8a94e76cbd8b60e43630440ff16860244d55db533a5b5152c62b07f77198859e9e1a6737bff274cf4d675ba76782da0f5d1daf1100521e2fba5d655b94de
SSDEEP

12288:aHqClQkf4WNWL821Jmecs00yznXjNdwFEoBxB7TKL7GoWny3Sv7n5lm/JfhSac:aH32U

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

ted.exe

pid process

312 ted.exe
312 ted.exe
312 ted.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ted.exe

description pid process

Token: SeDebugPrivilege 312 ted.exe

C:\Users\Admin\AppData\Local\Temp\ted.exe
"C:\Users\Admin\AppData\Local\Temp\ted.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/312-54-0x0000000074B50000-0x00000000750FB000-memory.dmp

Filesize
5.7MB

Download
memory/312-55-0x0000000074B50000-0x00000000750FB000-memory.dmp

Filesize
5.7MB

Download
memory/312-56-0x0000000000A90000-0x0000000000AD0000-memory.dmp

Filesize
256KB

Download
memory/312-57-0x0000000074B50000-0x00000000750FB000-memory.dmp

Filesize
5.7MB

Download