1572dd64754006c0a1cec9d9272b56b432f4e5bc811641f37979a9caa27d2ba5 | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 17:37

Sharing

Report Analysis Logs

General

Target

08b9bb843283b15c7650a72c9dd10ff2.exe
Size

104KB
MD5

08b9bb843283b15c7650a72c9dd10ff2
SHA1

c78453a045d9728c0b40e5649ddc499d7e54350e
SHA256

1572dd64754006c0a1cec9d9272b56b432f4e5bc811641f37979a9caa27d2ba5
SHA512

92be4cee35f94d97bb239c8f276c8175ec036e2113249b40b5f8b3fc366e5c8d5658b902316b73e1e05c3ae83fef2a9d01dad00f46968cfcc07fa9003e573821
SSDEEP

3072:L0fJduloxRzWIS+uI/ql/R/1E9y5f1pVU/1:L0fn+oxRzG/Nl9P1pVU/1

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\tutspq.dll	08b9bb843283b15c7650a72c9dd10ff2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3056	08b9bb843283b15c7650a72c9dd10ff2.exe
3056	08b9bb843283b15c7650a72c9dd10ff2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3056	08b9bb843283b15c7650a72c9dd10ff2.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 1248	3056	08b9bb843283b15c7650a72c9dd10ff2.exe	7

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1248
- C:\Users\Admin\AppData\Local\Temp\08b9bb843283b15c7650a72c9dd10ff2.exe
  "C:\Users\Admin\AppData\Local\Temp\08b9bb843283b15c7650a72c9dd10ff2.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1248-4-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/3056-2-0x0000000010000000-0x0000000010064000-memory.dmp

Filesize
400KB

Download
memory/3056-5-0x0000000010000000-0x0000000010064000-memory.dmp

Filesize
400KB

Download