77cb792e3da518b1c70b0efd0485bf48b35c12c7ac608e34c665a626bf8ebc33 | Triage

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 03:17

Sharing

Report Analysis Logs

General

Target

NewKp.exe
Size

574KB
MD5

c5ba0bb78c17207535f9202dd6158afd
SHA1

f81691dc2bf3fc2cb39797bb5275ad96386f5500
SHA256

03c2907a1212c55bb05119bf381f3649aaba23874f5c106e677cffa36b4b664d
SHA512

6c39178642bd9ae81d4b727e31f248763567af7f3a7b35ec66154980356b757c41faf9b16828e9e43ae84f438d0c5f3c16e0b64f8d7fbfe7515ac0c1b5c45c1f
SSDEEP

12288:mEIfs7yFh1ugpQ5AyHofF8f1b/KQJV4jdg:vwpLt8f1XT4jdg

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

NewKp.exe

description pid process

Token: SeDebugPrivilege 2972 NewKp.exe

C:\Users\Admin\AppData\Local\Temp\NewKp.exe
"C:\Users\Admin\AppData\Local\Temp\NewKp.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2972-0-0x0000000074B3E000-0x0000000074B3F000-memory.dmp

Filesize
4KB

Download
memory/2972-1-0x0000000000940000-0x00000000009D6000-memory.dmp

Filesize
600KB

Download
memory/2972-2-0x0000000074B30000-0x000000007521E000-memory.dmp

Filesize
6.9MB

Download
memory/2972-4-0x0000000074B30000-0x000000007521E000-memory.dmp

Filesize
6.9MB

Download