Analysis
- max time kernel
1s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
25/12/2023, 11:38
General
- Target ef534c72b800286824af370f3b98c75120a55d87b65e2bffba8d2ba0ab32a070.exe
- Size 1.3MB
- Sample231225-nrw29secbl
- SHA256 ef534c72b800286824af370f3b98c75120a55d87b65e2bffba8d2ba0ab32a070
Score
1/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef534c72b800286824af370f3b98c75120a55d87b65e2bffba8d2ba0ab32a070.exe"C:\Users\Admin\AppData\Local\Temp\ef534c72b800286824af370f3b98c75120a55d87b65e2bffba8d2ba0ab32a070.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3880-0-0x00000220DAAF0000-0x00000220DAB24000-memory.dmp
memory/3880-1-0x00007FFE7D750000-0x00007FFE7E211000-memory.dmp
memory/3880-4-0x00000220DAAE0000-0x00000220DAAF0000-memory.dmp
memory/3880-3-0x00000220DAAE0000-0x00000220DAAF0000-memory.dmp
memory/3880-2-0x00000220DAAE0000-0x00000220DAAF0000-memory.dmp
memory/3880-5-0x00000220DAAE0000-0x00000220DAAF0000-memory.dmp
memory/3880-6-0x00000220DB1C0000-0x00000220DB1C8000-memory.dmp
memory/3880-8-0x00000220F4FA0000-0x00000220F4FAE000-memory.dmp
memory/3880-7-0x00000220F4FE0000-0x00000220F5018000-memory.dmp
memory/3880-21-0x00007FFE7D750000-0x00007FFE7E211000-memory.dmp
memory/3880-22-0x00000220DAAE0000-0x00000220DAAF0000-memory.dmp
memory/3880-23-0x00000220DAAE0000-0x00000220DAAF0000-memory.dmp