e1805fa3c90f07f9721ad4bf4f42caf89cc5c3d45e0240c98cd34426caa4e670 | Triage

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2023 14:45

Sharing

Report Analysis Logs

General

Target

769aeae232c6162cedcb6c7255640c4c.exe
Size

6KB
MD5

769aeae232c6162cedcb6c7255640c4c
SHA1

e8b668452e30354f4d84731e4fa1aca10babe26d
SHA256

e1805fa3c90f07f9721ad4bf4f42caf89cc5c3d45e0240c98cd34426caa4e670
SHA512

0bd557f63f96319cc50f4be4baebe8dd9aed512a6d73019aee85296e6dfbdd4a64b7534f9fc122257597eeac079dff9b17feb928c5cd5e286e017414672a6537
SSDEEP

96:HNbsiqQQTFJr9e3EvblTaLo2ficCJSsTePtboyj:xs86FDe3+ezicCJSsTeP1oyj

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2936	769aeae232c6162cedcb6c7255640c4c.exe
2936	769aeae232c6162cedcb6c7255640c4c.exe
2936	769aeae232c6162cedcb6c7255640c4c.exe
2936	769aeae232c6162cedcb6c7255640c4c.exe
2936	769aeae232c6162cedcb6c7255640c4c.exe
2936	769aeae232c6162cedcb6c7255640c4c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2936	769aeae232c6162cedcb6c7255640c4c.exe

C:\Users\Admin\AppData\Local\Temp\769aeae232c6162cedcb6c7255640c4c.exe
"C:\Users\Admin\AppData\Local\Temp\769aeae232c6162cedcb6c7255640c4c.exe"
1⤵
PID:1660

C:\Users\Admin\AppData\Local\Temp\769aeae232c6162cedcb6c7255640c4c.exe
C:\Users\Admin\AppData\Local\Temp\769aeae232c6162cedcb6c7255640c4c.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads