a4b8ae7dd41e3b74ac8c4e7f18961b310d3868dd869501eadc95c50eaa1be64f | Triage

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 17:35

Sharing

Report Analysis Logs

General

Target

tmp.exe
Size

3.4MB
MD5

03a27a240c6cd820547266fcb39d58de
SHA1

9909a4eaf49b55753e4bb65fec3f6ace9776496d
SHA256

a4b8ae7dd41e3b74ac8c4e7f18961b310d3868dd869501eadc95c50eaa1be64f
SHA512

1ccd203eef659aac9c4209c63b094ba89936021ee8f3864b0df61b98f1e6166c4ad5b0d5d9038d1dba717e9f82c8f81cba79483a971a76f61c6cedd0e44d14a7
SSDEEP

98304:Lke6FPl+8aoJHAz3IfcPAS0M9RB/aTFLOAkGkzdnEVomFHKnPqe68:wHWsoH+yRB/aTFLOyomFHKnPHp

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

tmp.exe

pid process

2260 tmp.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

tmp.exe

description pid process

Token: SeDebugPrivilege 2260 tmp.exe
Token: SeDebugPrivilege 2260 tmp.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

tmp.exe

pid process

2260 tmp.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2260-2-0x00000000005B0000-0x00000000005CE000-memory.dmp

Filesize
120KB

Download
memory/2260-3-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download