Analysis

  • max time kernel
    154s
  • max time network
    171s
  • platform
    windows7_x64
  • resource
    win7-20231025-en
  • resource tags

    arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
  • submitted
    10-11-2023 06:20

General

  • Target

    Qfegtu.exe

  • Size

    194KB

  • MD5

    a8926cfefd4e4f3ddc9d8720983a4672

  • SHA1

    f964791303ce5fd8a51c8ca3eb9fdb9cbd259e74

  • SHA256

    83faafb87f3e0ba23d01e4d4bda9eabf50f9301673bf32640b8204e3fe249362

  • SHA512

    611f4f8a76c248c536c551e8936daffcab66e921cf9796d763c9bd620f6e15419db3280d2b0c23680b08ad4efa6b7262ac0b7fa6fb22a61e93fe5c1f929fc459

  • SSDEEP

    1536:DM24LqnX0QsvKf4m/4qXlvZJJflJATUcC7T+T0tfHgVEbFM2FND64c+:D+vDmQqflSLCOuHIERMKND643

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Qfegtu.exe
    "C:\Users\Admin\AppData\Local\Temp\Qfegtu.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2464-0-0x00000000010E0000-0x0000000001116000-memory.dmp

    Filesize

    216KB

  • memory/2464-1-0x00000000746F0000-0x0000000074DDE000-memory.dmp

    Filesize

    6.9MB

  • memory/2464-2-0x00000000004F0000-0x0000000000530000-memory.dmp

    Filesize

    256KB

  • memory/2464-3-0x00000000746F0000-0x0000000074DDE000-memory.dmp

    Filesize

    6.9MB

  • memory/2464-4-0x00000000004F0000-0x0000000000530000-memory.dmp

    Filesize

    256KB