368f8641f2411436b2cb4227a3ba921c1f32f28a19bb569d767b3768df90a7c1 | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 12:54

Sharing

Report Analysis Logs

General

Target

1928bd4c1d431d40c5222ff1d6d3978b.exe
Size

96KB
MD5

1928bd4c1d431d40c5222ff1d6d3978b
SHA1

3384f046e372a76ce8193dc0920552bd2e2138c6
SHA256

368f8641f2411436b2cb4227a3ba921c1f32f28a19bb569d767b3768df90a7c1
SHA512

1357a21973bfbce0f61917428436bfa1b5a6523b1622e60784437028cdac6e84ad705563627a6b776c6ae4204ca0bc9d459a71883599a168d528d793113d56e6
SSDEEP

768:ktZ//4L9vuEX+Pjn93xiIMvGiznr2Clm4:U/Dz93xi7vbznr2am4

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2968	1928bd4c1d431d40c5222ff1d6d3978b.exe

C:\Users\Admin\AppData\Local\Temp\1928bd4c1d431d40c5222ff1d6d3978b.exe
"C:\Users\Admin\AppData\Local\Temp\1928bd4c1d431d40c5222ff1d6d3978b.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2968-0-0x00000000002E0000-0x00000000002FE000-memory.dmp

Filesize
120KB

Download
memory/2968-1-0x0000000073E80000-0x000000007456E000-memory.dmp

Filesize
6.9MB

Download
memory/2968-3-0x0000000000690000-0x0000000000790000-memory.dmp

Filesize
1024KB

Download
memory/2968-4-0x0000000073E80000-0x000000007456E000-memory.dmp

Filesize
6.9MB

Download