5c5129fb75c6338317e77860ac1b31739dd72160d5c3f24e3e48e92324196cc4 | Triage

Analysis

max time kernel
67s
max time network
55s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29-04-2024 15:22

Sharing

Report Analysis Logs

General

Target

zNHdzFVZNFvIrv.exe
Size

185KB
MD5

327a06376dce413bf108947bd6707b18
SHA1

37e8f9310c342957b1cc2b6257962eea8e065567
SHA256

5c5129fb75c6338317e77860ac1b31739dd72160d5c3f24e3e48e92324196cc4
SHA512

9be8155857c7a3a3cea9567e3a7c5e87656c3f9240e5dcc269552829518919024ca2411dbd85a9926c264e2597b45ff7583d0b4829613c6390510aae46cb8546
SSDEEP

3072:6iu4ZVMK/uJlYT86knnt7i+KMj6GCqOXVSBvxgxd:m+HO2knntr6COABvxy

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

zNHdzFVZNFvIrv.exe

description pid process

Token: SeDebugPrivilege 1184 zNHdzFVZNFvIrv.exe

C:\Users\Admin\AppData\Local\Temp\zNHdzFVZNFvIrv.exe
"C:\Users\Admin\AppData\Local\Temp\zNHdzFVZNFvIrv.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1184-0-0x0000000000B60000-0x0000000000B94000-memory.dmp

Filesize
208KB

Download
memory/1184-1-0x00007FF850090000-0x00007FF850B51000-memory.dmp

Filesize
10.8MB

Download
memory/1184-2-0x0000000002C00000-0x0000000002C10000-memory.dmp

Filesize
64KB

Download
memory/1184-3-0x00007FF850090000-0x00007FF850B51000-memory.dmp

Filesize
10.8MB

Download