7184ecf9db3c6c15ab1b97ebe8b9124c9eb5b4f9f63e9da59f6b8c63d2ff5aef | Triage

Analysis

max time kernel
143s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 18:43

Sharing

Report Analysis Logs

General

Target

00d07b1d2d4b1697e5c0964e68e61ec5.exe
Size

3.8MB
MD5

00d07b1d2d4b1697e5c0964e68e61ec5
SHA1

4515172894286770568694602b7384b3f35d8798
SHA256

7184ecf9db3c6c15ab1b97ebe8b9124c9eb5b4f9f63e9da59f6b8c63d2ff5aef
SHA512

cbf2664be07e854f7a80d0b04596f5728d12d055f357096ccd4d0131ec96ba67e5f70579a51be9fcb7ed0cb7c16b052840d8227b12a184fdec6b3efdfa19d7f2
SSDEEP

98304:877Pmq33rE/JDLPWZADUGer7B6iY74M/UmlwXVZaFB:K+R/eZADUXR

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

00d07b1d2d4b1697e5c0964e68e61ec5.exe

pid	process
2324	00d07b1d2d4b1697e5c0964e68e61ec5.exe
2324	00d07b1d2d4b1697e5c0964e68e61ec5.exe
2324	00d07b1d2d4b1697e5c0964e68e61ec5.exe
2324	00d07b1d2d4b1697e5c0964e68e61ec5.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

00d07b1d2d4b1697e5c0964e68e61ec5.exe

description	pid	process
Token: SeDebugPrivilege	2324	00d07b1d2d4b1697e5c0964e68e61ec5.exe
Token: SeShutdownPrivilege	2324	00d07b1d2d4b1697e5c0964e68e61ec5.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

00d07b1d2d4b1697e5c0964e68e61ec5.exe

pid process

2324 00d07b1d2d4b1697e5c0964e68e61ec5.exe
2324 00d07b1d2d4b1697e5c0964e68e61ec5.exe

C:\Users\Admin\AppData\Local\Temp\00d07b1d2d4b1697e5c0964e68e61ec5.exe
"C:\Users\Admin\AppData\Local\Temp\00d07b1d2d4b1697e5c0964e68e61ec5.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2324

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...