47e1b6ef1edfe64545c28bc9fe21629f08f459c118b27a09324bc3418ee3ea03 | Triage

Analysis

max time kernel
118s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 13:06

Sharing

Report Analysis Logs

General

Target

196fce29b81c7a9e4bbc04b7e0c102ad.exe
Size

91KB
MD5

196fce29b81c7a9e4bbc04b7e0c102ad
SHA1

75940c58b13bd60f0dafb1dba1973e5d952bd35f
SHA256

47e1b6ef1edfe64545c28bc9fe21629f08f459c118b27a09324bc3418ee3ea03
SHA512

860ab992e5c479acf689631e8b7b236e25c7c2d15af8d3fdc1a479d6e83eb70965659bf1e1fc97ad5d1d0d8b0bf11ad5d90e6f353649798423e0437b6e162a43
SSDEEP

1536:EGwtRxOBJyypgmDjVwCfIAIYfGJmIMWtEMfgjtEFz:NwtRonyypexoiNtxYGz

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1864	196fce29b81c7a9e4bbc04b7e0c102ad.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1864	196fce29b81c7a9e4bbc04b7e0c102ad.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1864	196fce29b81c7a9e4bbc04b7e0c102ad.exe

C:\Users\Admin\AppData\Local\Temp\196fce29b81c7a9e4bbc04b7e0c102ad.exe
"C:\Users\Admin\AppData\Local\Temp\196fce29b81c7a9e4bbc04b7e0c102ad.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads