b435c364e8d41086dd4cc59c5c056569103cfda13e8666a9c05f7a9f3a5bb289 | Triage

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 12:11

Sharing

Report Analysis Logs

General

Target

c5d7afba8d991fc2ad0723f3ded17462.exe
Size

65KB
MD5

c5d7afba8d991fc2ad0723f3ded17462
SHA1

3e7bfd8be79d5efc9d1f2cd0388a255e262c69c4
SHA256

b435c364e8d41086dd4cc59c5c056569103cfda13e8666a9c05f7a9f3a5bb289
SHA512

41bb70dd47558259c77960bf45a151b2aded84181e5a6a25cd2857df1f52fc1c2b662cd87fc9761954e403dfb954f55380f0240a8076b83667e0980f8a2806eb
SSDEEP

768:NzS7vkxEwhjl8H2iaT1B0jBGndeRl8pWCgt/PRlxY:VAIjgm1B0FGdeRTCgt/5Y

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeBackupPrivilege	4140	c5d7afba8d991fc2ad0723f3ded17462.exe
Token: SeRestorePrivilege	4140	c5d7afba8d991fc2ad0723f3ded17462.exe
Token: SeRestorePrivilege	4140	c5d7afba8d991fc2ad0723f3ded17462.exe
Token: SeRestorePrivilege	4140	c5d7afba8d991fc2ad0723f3ded17462.exe
Token: SeRestorePrivilege	4140	c5d7afba8d991fc2ad0723f3ded17462.exe
Token: SeBackupPrivilege	4140	c5d7afba8d991fc2ad0723f3ded17462.exe
Token: SeRestorePrivilege	4140	c5d7afba8d991fc2ad0723f3ded17462.exe
Token: SeRestorePrivilege	4140	c5d7afba8d991fc2ad0723f3ded17462.exe
Token: SeRestorePrivilege	4140	c5d7afba8d991fc2ad0723f3ded17462.exe
Token: SeRestorePrivilege	4140	c5d7afba8d991fc2ad0723f3ded17462.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 544	4140	c5d7afba8d991fc2ad0723f3ded17462.exe	88
PID 4140 wrote to memory of 544	4140	c5d7afba8d991fc2ad0723f3ded17462.exe	88
PID 4140 wrote to memory of 544	4140	c5d7afba8d991fc2ad0723f3ded17462.exe	88

C:\Users\Admin\AppData\Local\Temp\c5d7afba8d991fc2ad0723f3ded17462.exe
"C:\Users\Admin\AppData\Local\Temp\c5d7afba8d991fc2ad0723f3ded17462.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:544

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4140-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4140-3-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download