5cf3e20473a9894fff89059bcdd2dc50fe662a337354ba65d3b630e745a8c386 | Triage

Analysis

max time kernel
461s
max time network
463s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
20/04/2024, 19:40

Sharing

Report Analysis Logs

General

Target

Jn6uV4udrU.exe
Size

1.0MB
MD5

add072102b5a6737bab018a741b85963
SHA1

041408109a2020f1874456ee0dbac266b4a46692
SHA256

5cf3e20473a9894fff89059bcdd2dc50fe662a337354ba65d3b630e745a8c386
SHA512

0b2cd8cfcb765bedfe8a6ea366dfad49ccc617b42cc6a02009f980ad07e85cdc0f8d3a9cc3593d1a4149c33b817a9b49ee0f306d3ad2c7c14b9aef22929ce3ce
SSDEEP

24576:b49ofzs1dTWhVk+zBu7JY8wWyiklHNsSQI:b494Q2Ogu7JYGWlpQI

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2148	Jn6uV4udrU.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2148	Jn6uV4udrU.exe

C:\Users\Admin\AppData\Local\Temp\Jn6uV4udrU.exe
"C:\Users\Admin\AppData\Local\Temp\Jn6uV4udrU.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:2148

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2148-0-0x00000241D1B40000-0x00000241D1C10000-memory.dmp

Filesize
832KB

Download
memory/2148-1-0x00007FFA652E0000-0x00007FFA652F0000-memory.dmp

Filesize
64KB

Download