4376e35b0c234d6340c34ef19aa250a116901a2a1b04667cf36d05d427bc5d57 | Triage

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13-10-2023 20:49

Sharing

Report Analysis Logs

General

Target

tftpd32.exe
Size

196KB
MD5

126e33bbdc201d71ebe44de6f71c31ea
SHA1

f464708be76ec9d9d32169dd45f1f65c6ad4e407
SHA256

f938cdac6e521e248b89880f5059738960e5d86ee6e0313a3981bcb27442b89c
SHA512

26d4a6be357a39c45b5fe8a9f17689d8574dd2402af2061b5f520e32f3257407d8cfebbf8458cd809ccb1ca6845cf1b5c542812c21c7ab05edb58e0e6c6f7864
SSDEEP

3072:HFf1WItr9y6Z+0KnChoWGxsFh17UjCEQ5uYXj1cq1JxssnOSltrP:lf19/+0KnOTFh1Q2wYXVhNZr

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1672	tftpd32.exe
Token: SeIncBasePriorityPrivilege	1672	tftpd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1672	tftpd32.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1672	tftpd32.exe

C:\Users\Admin\AppData\Local\Temp\tftpd32.exe
"C:\Users\Admin\AppData\Local\Temp\tftpd32.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads