aa6e3a3f06fbf1a9b6fd3c03afd97abb83adcaa63e68bf41e83fe0ff2aff02e1 | Triage

Analysis

max time kernel
141s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 23:30

Sharing

Report Analysis Logs

General

Target

AutoGuarder2.3.7.350/kill_folder.exe
Size

595KB
MD5

93bc7bded27e2ec4351cdf28c59901d8
SHA1

fb9fbd5c299380b1164e1cda29c835623b36a14b
SHA256

c057653bd1bf4dbc9ebcae98a022a4a3e15de793a36553b22dbebc5d2d5f5d85
SHA512

670c22f0ed6471fc4e959081775c459ee87e288ad87288ffb87c32640b12e000661dadd283abd1fc147089a9249af3a2005bfccfdc5e1623b846a99d57fa5b1d
SSDEEP

12288:mwMsa8FON/Xj/r3wSShjhLpRqHMMU5ublhuGGY:/k/z/rmNRUw5uTl

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral13/memory/2472-0-0x0000000000400000-0x00000000005BD000-memory.dmp	upx
behavioral13/memory/2472-2-0x0000000000400000-0x00000000005BD000-memory.dmp	upx

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2472	kill_folder.exe

C:\Users\Admin\AppData\Local\Temp\AutoGuarder2.3.7.350\kill_folder.exe
"C:\Users\Admin\AppData\Local\Temp\AutoGuarder2.3.7.350\kill_folder.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2472-0-0x0000000000400000-0x00000000005BD000-memory.dmp

Filesize
1.7MB

Download
memory/2472-1-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2472-2-0x0000000000400000-0x00000000005BD000-memory.dmp

Filesize
1.7MB

Download
memory/2472-4-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download