Analysis
-
max time kernel
148s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 09:10
Behavioral task
behavioral1
Sample
2316-4-0x0000000000470000-0x000000000047C000-memory.exe
Resource
win7-20240220-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2316-4-0x0000000000470000-0x000000000047C000-memory.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
2316-4-0x0000000000470000-0x000000000047C000-memory.exe
-
Size
48KB
-
MD5
c6f0d87977bf54aadc230b99a7ff093c
-
SHA1
542a167dee3830b6b9cdca1110dc83d221a07e0c
-
SHA256
56ab774fedce3b7d6b2264799749708db0fa70cd26e3211abb4850cf78801e01
-
SHA512
eeaeb4517152772c253e878c61b064f35ca97e5180191885f39a9dfa9063812338303b0e24da60b72105a797b0cfb54c32bb7e1215f469683ab3fb2d703684a4
-
SSDEEP
384:+0bUe5XB4e0XuOZeANuiEO0YaHWTgtTUFQqzF8Obbm:vT9ButIguiEYuebm
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 37 IoCs
Processes:
2316-4-0x0000000000470000-0x000000000047C000-memory.exedescription pid process Token: SeDebugPrivilege 2064 2316-4-0x0000000000470000-0x000000000047C000-memory.exe Token: 33 2064 2316-4-0x0000000000470000-0x000000000047C000-memory.exe Token: SeIncBasePriorityPrivilege 2064 2316-4-0x0000000000470000-0x000000000047C000-memory.exe Token: 33 2064 2316-4-0x0000000000470000-0x000000000047C000-memory.exe Token: SeIncBasePriorityPrivilege 2064 2316-4-0x0000000000470000-0x000000000047C000-memory.exe Token: 33 2064 2316-4-0x0000000000470000-0x000000000047C000-memory.exe Token: SeIncBasePriorityPrivilege 2064 2316-4-0x0000000000470000-0x000000000047C000-memory.exe Token: 33 2064 2316-4-0x0000000000470000-0x000000000047C000-memory.exe Token: SeIncBasePriorityPrivilege 2064 2316-4-0x0000000000470000-0x000000000047C000-memory.exe Token: 33 2064 2316-4-0x0000000000470000-0x000000000047C000-memory.exe Token: SeIncBasePriorityPrivilege 2064 2316-4-0x0000000000470000-0x000000000047C000-memory.exe Token: 33 2064 2316-4-0x0000000000470000-0x000000000047C000-memory.exe Token: SeIncBasePriorityPrivilege 2064 2316-4-0x0000000000470000-0x000000000047C000-memory.exe Token: 33 2064 2316-4-0x0000000000470000-0x000000000047C000-memory.exe Token: SeIncBasePriorityPrivilege 2064 2316-4-0x0000000000470000-0x000000000047C000-memory.exe Token: 33 2064 2316-4-0x0000000000470000-0x000000000047C000-memory.exe Token: SeIncBasePriorityPrivilege 2064 2316-4-0x0000000000470000-0x000000000047C000-memory.exe Token: 33 2064 2316-4-0x0000000000470000-0x000000000047C000-memory.exe Token: SeIncBasePriorityPrivilege 2064 2316-4-0x0000000000470000-0x000000000047C000-memory.exe Token: 33 2064 2316-4-0x0000000000470000-0x000000000047C000-memory.exe Token: SeIncBasePriorityPrivilege 2064 2316-4-0x0000000000470000-0x000000000047C000-memory.exe Token: 33 2064 2316-4-0x0000000000470000-0x000000000047C000-memory.exe Token: SeIncBasePriorityPrivilege 2064 2316-4-0x0000000000470000-0x000000000047C000-memory.exe Token: 33 2064 2316-4-0x0000000000470000-0x000000000047C000-memory.exe Token: SeIncBasePriorityPrivilege 2064 2316-4-0x0000000000470000-0x000000000047C000-memory.exe Token: 33 2064 2316-4-0x0000000000470000-0x000000000047C000-memory.exe Token: SeIncBasePriorityPrivilege 2064 2316-4-0x0000000000470000-0x000000000047C000-memory.exe Token: 33 2064 2316-4-0x0000000000470000-0x000000000047C000-memory.exe Token: SeIncBasePriorityPrivilege 2064 2316-4-0x0000000000470000-0x000000000047C000-memory.exe Token: 33 2064 2316-4-0x0000000000470000-0x000000000047C000-memory.exe Token: SeIncBasePriorityPrivilege 2064 2316-4-0x0000000000470000-0x000000000047C000-memory.exe Token: 33 2064 2316-4-0x0000000000470000-0x000000000047C000-memory.exe Token: SeIncBasePriorityPrivilege 2064 2316-4-0x0000000000470000-0x000000000047C000-memory.exe Token: 33 2064 2316-4-0x0000000000470000-0x000000000047C000-memory.exe Token: SeIncBasePriorityPrivilege 2064 2316-4-0x0000000000470000-0x000000000047C000-memory.exe Token: 33 2064 2316-4-0x0000000000470000-0x000000000047C000-memory.exe Token: SeIncBasePriorityPrivilege 2064 2316-4-0x0000000000470000-0x000000000047C000-memory.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2064-0-0x00000000746A1000-0x00000000746A2000-memory.dmpFilesize
4KB
-
memory/2064-1-0x00000000746A0000-0x0000000074C4B000-memory.dmpFilesize
5.7MB
-
memory/2064-2-0x00000000746A0000-0x0000000074C4B000-memory.dmpFilesize
5.7MB
-
memory/2064-3-0x00000000746A0000-0x0000000074C4B000-memory.dmpFilesize
5.7MB