Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    29-08-2023 05:37

General

  • Target

    RFQ 6000066536 - PR 10023150.exe

  • Size

    293KB

  • MD5

    c07dcacf891f050de64a473f24de09cc

  • SHA1

    44c85573c7de6ae59fabc6e74aa858db35bfba74

  • SHA256

    1848ae732a316881124c9a7e3e1c29c308d78706f2159b79e125fe919f3d80b9

  • SHA512

    4270727e1a92df5d71b40a7031ab0e37a0524f30699bcf2a3d23357ffca657f433f8b69dd6b3d944e1ee267944f28a5d6f237d8ec00980069e60aa21e0472f11

  • SSDEEP

    6144:vZla6Ee3o9u8/kjEHlo0AfYj+QU4s9ck1+9WpTU03oRknTjzRn2XlNq/TiwTzRc:vfa6Ee4pGEFo0mYj+Nd+9WpoR

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RFQ 6000066536 - PR 10023150.exe
    "C:\Users\Admin\AppData\Local\Temp\RFQ 6000066536 - PR 10023150.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2556-0-0x00000000010B0000-0x0000000001100000-memory.dmp

    Filesize

    320KB

  • memory/2556-1-0x0000000074630000-0x0000000074D1E000-memory.dmp

    Filesize

    6.9MB

  • memory/2556-2-0x00000000005D0000-0x0000000000610000-memory.dmp

    Filesize

    256KB

  • memory/2556-3-0x0000000074630000-0x0000000074D1E000-memory.dmp

    Filesize

    6.9MB

  • memory/2556-4-0x00000000005D0000-0x0000000000610000-memory.dmp

    Filesize

    256KB