074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31-01-2025 18:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
Size

1.2MB
MD5

13b757a50feaac44dc101f91ad7c39b9
SHA1

bcb8ad86e11512f0e0434c3b9a88e7c137a61a1a
SHA256

074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4
SHA512

7e2ceec661df2dc078038bdd8bd64df838d0b30199c309750699f2b1863afe350151fdaa9a6359965fa4008a4ec48173fe1a9492bf13081c392ff04c4caf17fb
SSDEEP

24576:z5hTzBLs0NZ7zjtsWM8rMC5Zod8KyarDSVXT5XuY:LzBs0L7/e9jyK14XT5XuY

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
Token: SeDebugPrivilege	2672	074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe

C:\Users\Admin\AppData\Local\Temp\074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe
"C:\Users\Admin\AppData\Local\Temp\074242122dd81f47e3bbf6a4159345c4b91a9fa641a3a721f2577d216b1ec4f4.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2672-0-0x000007FEF59D3000-0x000007FEF59D4000-memory.dmp

Filesize
4KB

Download
memory/2672-1-0x0000000001BA0000-0x0000000001BD4000-memory.dmp

Filesize
208KB

Download
memory/2672-2-0x000007FEF59D0000-0x000007FEF63BC000-memory.dmp

Filesize
9.9MB

Download
memory/2672-3-0x000007FEF59D0000-0x000007FEF63BC000-memory.dmp

Filesize
9.9MB

Download
memory/2672-4-0x000007FEF59D0000-0x000007FEF63BC000-memory.dmp

Filesize
9.9MB

Download
memory/2672-5-0x000007FEF59D0000-0x000007FEF63BC000-memory.dmp

Filesize
9.9MB

Download
memory/2672-6-0x00000000005F0000-0x00000000005FA000-memory.dmp

Filesize
40KB

Download
memory/2672-7-0x00000000005F0000-0x00000000005FA000-memory.dmp

Filesize
40KB

Download
memory/2672-8-0x000007FEF59D0000-0x000007FEF63BC000-memory.dmp

Filesize
9.9MB

Download
memory/2672-12-0x000007FEF59D0000-0x000007FEF63BC000-memory.dmp

Filesize
9.9MB

Download
memory/2672-13-0x000007FEF59D0000-0x000007FEF63BC000-memory.dmp

Filesize
9.9MB

Download
memory/2672-33-0x000007FEF59D3000-0x000007FEF59D4000-memory.dmp

Filesize
4KB

Download
memory/2672-37-0x000007FEF59D0000-0x000007FEF63BC000-memory.dmp

Filesize
9.9MB

Download
memory/2672-38-0x000007FEF59D0000-0x000007FEF63BC000-memory.dmp

Filesize
9.9MB

Download
memory/2672-39-0x000007FEF59D0000-0x000007FEF63BC000-memory.dmp

Filesize
9.9MB

Download
memory/2672-40-0x00000000005F0000-0x00000000005FA000-memory.dmp

Filesize
40KB

Download
memory/2672-41-0x00000000005F0000-0x00000000005FA000-memory.dmp

Filesize
40KB

Download
memory/2672-42-0x000007FEF59D0000-0x000007FEF63BC000-memory.dmp

Filesize
9.9MB

Download
memory/2672-43-0x000007FEF59D0000-0x000007FEF63BC000-memory.dmp

Filesize
9.9MB

Download