Analysis

  • max time kernel
    120s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    04/09/2023, 09:35

General

  • Target

    BL.exe

  • Size

    222KB

  • MD5

    15e15900328616144d406a9555d29381

  • SHA1

    f72f15a6b6f5fb43806f383177242b0a930aa2b7

  • SHA256

    cbc8fcdf10136e947c68cc5cc2b55364ef04a30c92c4b875cc194a675b322ec7

  • SHA512

    069e91db25bfc03be79b5a2190589b903b1b6cc48ef2957c353111444a4cb9fb46665df8076a1949fe214d6b258654dd15c60d9be7be10434dbd57daacc1a8fb

  • SSDEEP

    6144:xRYpSXH459O6ghklF0Z6vUbB/n1q+LqzEw:xRYp8HYTghkLg6viv

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BL.exe
    "C:\Users\Admin\AppData\Local\Temp\BL.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1248

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1248-0-0x0000000000F10000-0x0000000000F4E000-memory.dmp

    Filesize

    248KB

  • memory/1248-1-0x0000000074AF0000-0x00000000751DE000-memory.dmp

    Filesize

    6.9MB

  • memory/1248-2-0x0000000004450000-0x0000000004490000-memory.dmp

    Filesize

    256KB

  • memory/1248-3-0x0000000074AF0000-0x00000000751DE000-memory.dmp

    Filesize

    6.9MB

  • memory/1248-4-0x0000000004450000-0x0000000004490000-memory.dmp

    Filesize

    256KB

  • memory/1248-5-0x0000000004450000-0x0000000004490000-memory.dmp

    Filesize

    256KB

  • memory/1248-6-0x0000000004450000-0x0000000004490000-memory.dmp

    Filesize

    256KB