f54e3cdf69e8a663f5f87982a41cddf1b7d4ea4c39b0eddcf556f18d4be55196 | Triage

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
18-01-2024 09:36

Sharing

Report Analysis Logs

General

Target

650f8621454f7d937a69c5e39da295da.exe
Size

14KB
MD5

650f8621454f7d937a69c5e39da295da
SHA1

0993dc7a4c5d98a78a6475727d6dbfe0eb836a0c
SHA256

f54e3cdf69e8a663f5f87982a41cddf1b7d4ea4c39b0eddcf556f18d4be55196
SHA512

3f34a6314e9a454c6aeed89a401622a00bcc4a17aabeda929b0da3125fc355daf452021c27329370618e1c22c75892e1300b37c8b94fab97217e255dad81755c
SSDEEP

384:eYzqHUOFK8Lys9lJig8u4PMcqnPnZct78:ZGUIrLV97ig8lqCt78

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ld732.tmp	650f8621454f7d937a69c5e39da295da.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2284	650f8621454f7d937a69c5e39da295da.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2284	650f8621454f7d937a69c5e39da295da.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 436	2284	650f8621454f7d937a69c5e39da295da.exe	3

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:436

C:\Users\Admin\AppData\Local\Temp\650f8621454f7d937a69c5e39da295da.exe
"C:\Users\Admin\AppData\Local\Temp\650f8621454f7d937a69c5e39da295da.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/436-1-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download