3872c12d31fc9825e8661ac01ecee2572460677afbc7093f920a8436a42e28ff | Triage

Resubmissions

03-07-2024 08:39

240703-kkjxksyfkk 6

03-07-2024 08:38

240703-kjt16ayern 3

Analysis

max time kernel
42s
max time network
16s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
03-07-2024 08:38

Sharing

Report Analysis Logs

General

Target

MEMZ.exe
Size

16KB
MD5

1d5ad9c8d3fee874d0feb8bfac220a11
SHA1

ca6d3f7e6c784155f664a9179ca64e4034df9595
SHA256

3872c12d31fc9825e8661ac01ecee2572460677afbc7093f920a8436a42e28ff
SHA512

c8246f4137416be33b6d1ac89f2428b7c44d9376ac8489a9fbf65ef128a6c53fb50479e1e400c8e201c8611992ab1d6c1bd3d6cece89013edb4d35cdd22305b1
SSDEEP

192:M2WgyvSW8gRc6olcIEiwqZKBkDFR43xWTM3LHf26gFrcx3sNq:JWgnSmFlcIqq3agmLH+6gF23sN

Score

1^/10

Malware Config

Signatures

Kills process with taskkill 1 IoCs

pid	Process
2852	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2852	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"
1⤵
PID:1652

C:\Windows\system32\wininit.exe
"C:\Windows\system32\wininit.exe"
1⤵
PID:2588

C:\Windows\system32\wininit.exe
"C:\Windows\system32\wininit.exe"
1⤵
PID:2724

C:\Windows\system32\taskkill.exe
"C:\Windows\system32\taskkill.exe" -f -im wininit.exe
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads