Overview
overview
8Static
static
34f80163bd...a9.exe
windows7_x64
134f80163bd...a9.exe
windows10_x64
13befc90b32...b3.exe
windows7_x64
13befc90b32...b3.exe
windows10_x64
1409b8d4d4b...3e.exe
windows7_x64
1409b8d4d4b...3e.exe
windows10_x64
1485a1b8434...47.exe
windows7_x64
8485a1b8434...47.exe
windows10_x64
84e000f7c66...68.exe
windows7_x64
84e000f7c66...68.exe
windows10_x64
8Analysis
-
max time kernel
35s -
max time network
37s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
14-01-2021 02:44
Static task
static1
Behavioral task
behavioral1
Sample
34f80163bd985506c7f1995bbdf9ec1c66a961f72b516e0476237afe200cd8a9.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
34f80163bd985506c7f1995bbdf9ec1c66a961f72b516e0476237afe200cd8a9.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
3befc90b32cbd8c426c62d8e0a6f62754b7cf336d807c763e224fae0767d74b3.exe
Resource
win7v20201028
Behavioral task
behavioral4
Sample
3befc90b32cbd8c426c62d8e0a6f62754b7cf336d807c763e224fae0767d74b3.exe
Resource
win10v20201028
Behavioral task
behavioral5
Sample
409b8d4d4b4a95003d90feda318a45b408222cb1e0e8cc0526e92ec281c47a3e.exe
Resource
win7v20201028
Behavioral task
behavioral6
Sample
409b8d4d4b4a95003d90feda318a45b408222cb1e0e8cc0526e92ec281c47a3e.exe
Resource
win10v20201028
Behavioral task
behavioral7
Sample
485a1b8434faa85a92902ea3308e6c438754edec4d97061f91f2984a0e64f947.exe
Resource
win7v20201028
Behavioral task
behavioral8
Sample
485a1b8434faa85a92902ea3308e6c438754edec4d97061f91f2984a0e64f947.exe
Resource
win10v20201028
Behavioral task
behavioral9
Sample
4e000f7c6675b883ccd174048d767cd3d75d61b9a7f56bae0563b2aa7fd26968.exe
Resource
win7v20201028
Behavioral task
behavioral10
Sample
4e000f7c6675b883ccd174048d767cd3d75d61b9a7f56bae0563b2aa7fd26968.exe
Resource
win10v20201028
General
-
Target
3befc90b32cbd8c426c62d8e0a6f62754b7cf336d807c763e224fae0767d74b3.exe
-
Size
1.4MB
-
MD5
0df8e282fcc2f29768fa1c09f5ebea66
-
SHA1
3f2b2c198c8fb32047920924695b8ccc01efb001
-
SHA256
3befc90b32cbd8c426c62d8e0a6f62754b7cf336d807c763e224fae0767d74b3
-
SHA512
34de4f6bbb6967d13ac1912693519457d22d372bd1928724d40ee6c15893fe0675f48a7d3221da35439c398b0f08c5b0dc958d80020b62cabb382846b3308f88
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
3befc90b32cbd8c426c62d8e0a6f62754b7cf336d807c763e224fae0767d74b3.exepid process 1204 3befc90b32cbd8c426c62d8e0a6f62754b7cf336d807c763e224fae0767d74b3.exe 1204 3befc90b32cbd8c426c62d8e0a6f62754b7cf336d807c763e224fae0767d74b3.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
3befc90b32cbd8c426c62d8e0a6f62754b7cf336d807c763e224fae0767d74b3.exedescription pid process Token: SeIncreaseQuotaPrivilege 1204 3befc90b32cbd8c426c62d8e0a6f62754b7cf336d807c763e224fae0767d74b3.exe Token: SeSecurityPrivilege 1204 3befc90b32cbd8c426c62d8e0a6f62754b7cf336d807c763e224fae0767d74b3.exe Token: SeTakeOwnershipPrivilege 1204 3befc90b32cbd8c426c62d8e0a6f62754b7cf336d807c763e224fae0767d74b3.exe Token: SeLoadDriverPrivilege 1204 3befc90b32cbd8c426c62d8e0a6f62754b7cf336d807c763e224fae0767d74b3.exe Token: SeSystemProfilePrivilege 1204 3befc90b32cbd8c426c62d8e0a6f62754b7cf336d807c763e224fae0767d74b3.exe Token: SeSystemtimePrivilege 1204 3befc90b32cbd8c426c62d8e0a6f62754b7cf336d807c763e224fae0767d74b3.exe Token: SeProfSingleProcessPrivilege 1204 3befc90b32cbd8c426c62d8e0a6f62754b7cf336d807c763e224fae0767d74b3.exe Token: SeIncBasePriorityPrivilege 1204 3befc90b32cbd8c426c62d8e0a6f62754b7cf336d807c763e224fae0767d74b3.exe Token: SeCreatePagefilePrivilege 1204 3befc90b32cbd8c426c62d8e0a6f62754b7cf336d807c763e224fae0767d74b3.exe Token: SeBackupPrivilege 1204 3befc90b32cbd8c426c62d8e0a6f62754b7cf336d807c763e224fae0767d74b3.exe Token: SeRestorePrivilege 1204 3befc90b32cbd8c426c62d8e0a6f62754b7cf336d807c763e224fae0767d74b3.exe Token: SeShutdownPrivilege 1204 3befc90b32cbd8c426c62d8e0a6f62754b7cf336d807c763e224fae0767d74b3.exe Token: SeDebugPrivilege 1204 3befc90b32cbd8c426c62d8e0a6f62754b7cf336d807c763e224fae0767d74b3.exe Token: SeSystemEnvironmentPrivilege 1204 3befc90b32cbd8c426c62d8e0a6f62754b7cf336d807c763e224fae0767d74b3.exe Token: SeChangeNotifyPrivilege 1204 3befc90b32cbd8c426c62d8e0a6f62754b7cf336d807c763e224fae0767d74b3.exe Token: SeRemoteShutdownPrivilege 1204 3befc90b32cbd8c426c62d8e0a6f62754b7cf336d807c763e224fae0767d74b3.exe Token: SeUndockPrivilege 1204 3befc90b32cbd8c426c62d8e0a6f62754b7cf336d807c763e224fae0767d74b3.exe Token: SeManageVolumePrivilege 1204 3befc90b32cbd8c426c62d8e0a6f62754b7cf336d807c763e224fae0767d74b3.exe Token: SeImpersonatePrivilege 1204 3befc90b32cbd8c426c62d8e0a6f62754b7cf336d807c763e224fae0767d74b3.exe Token: SeCreateGlobalPrivilege 1204 3befc90b32cbd8c426c62d8e0a6f62754b7cf336d807c763e224fae0767d74b3.exe Token: 33 1204 3befc90b32cbd8c426c62d8e0a6f62754b7cf336d807c763e224fae0767d74b3.exe Token: 34 1204 3befc90b32cbd8c426c62d8e0a6f62754b7cf336d807c763e224fae0767d74b3.exe Token: 35 1204 3befc90b32cbd8c426c62d8e0a6f62754b7cf336d807c763e224fae0767d74b3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3befc90b32cbd8c426c62d8e0a6f62754b7cf336d807c763e224fae0767d74b3.exe"C:\Users\Admin\AppData\Local\Temp\3befc90b32cbd8c426c62d8e0a6f62754b7cf336d807c763e224fae0767d74b3.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken