Analysis
- max time kernel
146s - max time network
111s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:45
Static task
static1
Behavioral task
behavioral1
Sample
08c0f4831d9f0e3d57fbb7290e5fde4a50598b50676f76aaee3db9c079d500bc.exe
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
08c0f4831d9f0e3d57fbb7290e5fde4a50598b50676f76aaee3db9c079d500bc.exe
Resource
win10v20201028
0 signatures
0 seconds
General
- Target 08c0f4831d9f0e3d57fbb7290e5fde4a50598b50676f76aaee3db9c079d500bc.exe
- Size 317KB
- Sample201109-hpfaexpyqx
- SHA256 08c0f4831d9f0e3d57fbb7290e5fde4a50598b50676f76aaee3db9c079d500bc
- MD5 28b568e034c39c674f71c621dbe251ae
- SHA1 7515d1f12fa6a8ca1f085915e5a0e316fbe1332e
- SHA512 a3bb1075ea991f6e1c659d082809ae62e63fe0f2b1dc9e3fc076a9e6f8272d7e7c5c8fcbeda9e311c29b654498ed7a935fc2df00fa83d3cd317cf671345a41dd
- MD5 SHA1 SHA512
Score
1/10
Malware Config
Signatures
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4768 08c0f4831d9f0e3d57fbb7290e5fde4a50598b50676f76aaee3db9c079d500bc.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeShutdownPrivilege 4768 08c0f4831d9f0e3d57fbb7290e5fde4a50598b50676f76aaee3db9c079d500bc.exe Token: SeDebugPrivilege 4768 08c0f4831d9f0e3d57fbb7290e5fde4a50598b50676f76aaee3db9c079d500bc.exe Token: SeTcbPrivilege 4768 08c0f4831d9f0e3d57fbb7290e5fde4a50598b50676f76aaee3db9c079d500bc.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4768 08c0f4831d9f0e3d57fbb7290e5fde4a50598b50676f76aaee3db9c079d500bc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\08c0f4831d9f0e3d57fbb7290e5fde4a50598b50676f76aaee3db9c079d500bc.exe"C:\Users\Admin\AppData\Local\Temp\08c0f4831d9f0e3d57fbb7290e5fde4a50598b50676f76aaee3db9c079d500bc.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4768