301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c | Triage

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-02-2025 14:39

Sharing

Report Analysis Logs

General

Target

CF8F.exe
Size

60KB
MD5

347ac3b6b791054de3e5720a7144a977
SHA1

413eba3973a15c1a6429d9f170f3e8287f98c21c
SHA256

301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c
SHA512

9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787
SSDEEP

1536:QeRCKjey4TTGLeBYEUW1SIUDoCB449rHUV:KKjey4TTmeBZUGSIUDoCq49oV

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3028	CF8F.exe
3028	CF8F.exe
3028	CF8F.exe
3028	CF8F.exe
3028	CF8F.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3028	CF8F.exe

C:\Users\Admin\AppData\Local\Temp\CF8F.exe
"C:\Users\Admin\AppData\Local\Temp\CF8F.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads