5077111b1030c224e7f95035c72a76aaba1cdb91c941962f12a32ab733007b91 | Triage

Analysis

max time kernel
155s
max time network
171s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09-01-2024 18:46

Sharing

Report Analysis Logs

General

Target

e9571705ab3458c44f407abd73d20583.exe
Size

3.8MB
MD5

e9571705ab3458c44f407abd73d20583
SHA1

a1c7f7689a279c56193f94deb37483dae30dd97e
SHA256

5077111b1030c224e7f95035c72a76aaba1cdb91c941962f12a32ab733007b91
SHA512

b81199cbe9086262e97b4565ddd2ddf74967a299c183ae4781259d4aa06f0f96c2aef6c5621b7f77d1d6c8577be9708311ab9ba510019635af8174b54e2316ae
SSDEEP

98304:877Pmq33rE/JDLPWZADUGer7B6iY74M/2mlwXVZaFB:K+R/eZADUXR

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

e9571705ab3458c44f407abd73d20583.exe

pid	process
760	e9571705ab3458c44f407abd73d20583.exe
760	e9571705ab3458c44f407abd73d20583.exe
760	e9571705ab3458c44f407abd73d20583.exe
760	e9571705ab3458c44f407abd73d20583.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

e9571705ab3458c44f407abd73d20583.exe

description pid process

Token: SeDebugPrivilege 760 e9571705ab3458c44f407abd73d20583.exe
Token: SeShutdownPrivilege 760 e9571705ab3458c44f407abd73d20583.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

e9571705ab3458c44f407abd73d20583.exe

pid process

760 e9571705ab3458c44f407abd73d20583.exe
760 e9571705ab3458c44f407abd73d20583.exe

C:\Users\Admin\AppData\Local\Temp\e9571705ab3458c44f407abd73d20583.exe
"C:\Users\Admin\AppData\Local\Temp\e9571705ab3458c44f407abd73d20583.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...