dbe275d0b8e83c1eaede18b4824e07eeace857bcc23d41a9637535a66bcc973d | Triage

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/02/2024, 22:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

97c2b92d54c42a2a78f224f83f58a8a6.exe
Size

564KB
MD5

97c2b92d54c42a2a78f224f83f58a8a6
SHA1

28038147bef975bd63e86591c47ff95716d76565
SHA256

dbe275d0b8e83c1eaede18b4824e07eeace857bcc23d41a9637535a66bcc973d
SHA512

f7bbe74dfbbb09b5468188f548123fb8f2b7987399457badd6ffc773cf0e78fe9bb00b26374e32d9015ec213e015f92cc30395bad7784c316604d1323f28be6e
SSDEEP

12288:xRbu/jtigh+M9lbfx3yABdvStQiH4u3cS6yx:fOsghzh/WS6fcSn

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4724	97c2b92d54c42a2a78f224f83f58a8a6.exe
4724	97c2b92d54c42a2a78f224f83f58a8a6.exe
4724	97c2b92d54c42a2a78f224f83f58a8a6.exe
4724	97c2b92d54c42a2a78f224f83f58a8a6.exe
4724	97c2b92d54c42a2a78f224f83f58a8a6.exe
4724	97c2b92d54c42a2a78f224f83f58a8a6.exe
4724	97c2b92d54c42a2a78f224f83f58a8a6.exe
4724	97c2b92d54c42a2a78f224f83f58a8a6.exe
4724	97c2b92d54c42a2a78f224f83f58a8a6.exe
4724	97c2b92d54c42a2a78f224f83f58a8a6.exe
4724	97c2b92d54c42a2a78f224f83f58a8a6.exe
4724	97c2b92d54c42a2a78f224f83f58a8a6.exe
4724	97c2b92d54c42a2a78f224f83f58a8a6.exe
4724	97c2b92d54c42a2a78f224f83f58a8a6.exe
4724	97c2b92d54c42a2a78f224f83f58a8a6.exe
4724	97c2b92d54c42a2a78f224f83f58a8a6.exe
4724	97c2b92d54c42a2a78f224f83f58a8a6.exe
4724	97c2b92d54c42a2a78f224f83f58a8a6.exe
4724	97c2b92d54c42a2a78f224f83f58a8a6.exe
4724	97c2b92d54c42a2a78f224f83f58a8a6.exe
4724	97c2b92d54c42a2a78f224f83f58a8a6.exe
4724	97c2b92d54c42a2a78f224f83f58a8a6.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4724	97c2b92d54c42a2a78f224f83f58a8a6.exe

C:\Users\Admin\AppData\Local\Temp\97c2b92d54c42a2a78f224f83f58a8a6.exe
"C:\Users\Admin\AppData\Local\Temp\97c2b92d54c42a2a78f224f83f58a8a6.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4724-0-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/4724-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4724-3-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download