a29158eb8d65435a7f87236ded4e06cc5a53887f53bb4d8b6684350d636d2e00 | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:37

Sharing

Report Analysis Logs

General

Target

bin/restart64/restart64.exe
Size

73KB
MD5

297aa19bade534a791d053ca190b74ad
SHA1

15cb6a33994f75fe9e30a2afbc8a7e4616b63962
SHA256

5f779bb822aedaf5bd11693cdf73f6c7c3342f37371a78c07c2aca1e15dbfd00
SHA512

df883950c598f31b81f22a68b2a9fed7459dcad5084ec6e39399658b0492bcc458d9fc5bb80fda6bc994bed3241f969fc67a0b8e021fb82b040455d64776c625
SSDEEP

1536:8vXMJl7uRupZzidl/T+Dnx86Rpy4roKsIrryeq3OTM:8vMJl6RAZu/T+7x8qpRM8rNcOTM

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 3 IoCs

Processes:

restart64.exe

description	ioc	process
File opened for modification	C:\Windows\INF\setupapi.app.log	restart64.exe
File opened for modification	C:\Windows\setupact.log	restart64.exe
File opened for modification	C:\Windows\setuperr.log	restart64.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

restart64.exe

description pid process

Token: SeLoadDriverPrivilege 2428 restart64.exe
Token: SeLoadDriverPrivilege 2428 restart64.exe

C:\Users\Admin\AppData\Local\Temp\bin\restart64\restart64.exe
"C:\Users\Admin\AppData\Local\Temp\bin\restart64\restart64.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads