37a88b905f8ed19e1bd94fd282f575e2cfc58a83e35e922d1a35a0cc42bd61c6 | Triage

Analysis

max time kernel
0s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
30-08-2023 07:54

Sharing

Report Analysis Logs

General

Target

[email protected]
Size

618KB
MD5

a50fc0da1d2b3c4aa8a6adaccf69a5de
SHA1

e001f4043ab4be644ea10e0d65303d6e57b31ffe
SHA256

cf6eb8377789e316629c0396a2dbb53c69b5fd67bbd0e7163b8d305aaa756e90
SHA512

4bbc7676391ed4085f628d1f4e1f0af16f5cd6fd9efb8c61176bccdb6ee03b06896c6ddfba9fcf363b133ade3a8a1b8cd17ef92d8eb9adeec247f9bd41dbec2b
SSDEEP

12288:EQIfqOiX9P/aazd1ctyDXHrJW2dGMToCRn5VxWRaqsrOkqgyQD:EQIydX/d1rTLRd/TvVUsrOkqFQD

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2456-0-0x0000000000400000-0x000000000057F000-memory.dmp	upx

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2456	[email protected]

C:\Users\Admin\AppData\Local\Temp\[email protected]
"C:\Users\Admin\AppData\Local\Temp\[email protected]"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2456-0-0x0000000000400000-0x000000000057F000-memory.dmp

Filesize
1.5MB

Download
memory/2456-1-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download