Analysis
-
max time kernel
43s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220331-en -
submitted
09-04-2022 17:03
Static task
static1
Behavioral task
behavioral1
Sample
77c66b88869b232a86e9c7dffc9485a2b70a7334294b103374e7c682639f2f8e.exe
Resource
win7-20220331-en
windows7_x64
0 signatures
0 seconds
General
-
Target
77c66b88869b232a86e9c7dffc9485a2b70a7334294b103374e7c682639f2f8e.exe
-
Size
7.4MB
-
MD5
6013d9edcffeba86d2005652e25ff28c
-
SHA1
4ec549088f002bb90339e09a49f4dcdfd30feb5a
-
SHA256
77c66b88869b232a86e9c7dffc9485a2b70a7334294b103374e7c682639f2f8e
-
SHA512
67eaaaf158f8b1905a0f4c2750f7e11b85facf77e8c658057bcacda556011e62924ed1934dcfc3c2b8fbbe52a89c50d7339695b9fb864aeaa6173c6d1df0627a
Score
1/10
Malware Config
Signatures
-
NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\C:\Users\Admin\AppData\Local\Temp\77c66b88869b232a86e9c7dffc9485a2b70a7334294b103374e7c682639f2f8e.exe.lock 77c66b88869b232a86e9c7dffc9485a2b70a7334294b103374e7c682639f2f8e.exe -
Suspicious behavior: EnumeratesProcesses 27 IoCs
pid Process 1500 77c66b88869b232a86e9c7dffc9485a2b70a7334294b103374e7c682639f2f8e.exe 1500 77c66b88869b232a86e9c7dffc9485a2b70a7334294b103374e7c682639f2f8e.exe 1500 77c66b88869b232a86e9c7dffc9485a2b70a7334294b103374e7c682639f2f8e.exe 1500 77c66b88869b232a86e9c7dffc9485a2b70a7334294b103374e7c682639f2f8e.exe 1500 77c66b88869b232a86e9c7dffc9485a2b70a7334294b103374e7c682639f2f8e.exe 1500 77c66b88869b232a86e9c7dffc9485a2b70a7334294b103374e7c682639f2f8e.exe 1500 77c66b88869b232a86e9c7dffc9485a2b70a7334294b103374e7c682639f2f8e.exe 1500 77c66b88869b232a86e9c7dffc9485a2b70a7334294b103374e7c682639f2f8e.exe 1500 77c66b88869b232a86e9c7dffc9485a2b70a7334294b103374e7c682639f2f8e.exe 1500 77c66b88869b232a86e9c7dffc9485a2b70a7334294b103374e7c682639f2f8e.exe 1500 77c66b88869b232a86e9c7dffc9485a2b70a7334294b103374e7c682639f2f8e.exe 1500 77c66b88869b232a86e9c7dffc9485a2b70a7334294b103374e7c682639f2f8e.exe 1500 77c66b88869b232a86e9c7dffc9485a2b70a7334294b103374e7c682639f2f8e.exe 1500 77c66b88869b232a86e9c7dffc9485a2b70a7334294b103374e7c682639f2f8e.exe 1500 77c66b88869b232a86e9c7dffc9485a2b70a7334294b103374e7c682639f2f8e.exe 1500 77c66b88869b232a86e9c7dffc9485a2b70a7334294b103374e7c682639f2f8e.exe 1500 77c66b88869b232a86e9c7dffc9485a2b70a7334294b103374e7c682639f2f8e.exe 1500 77c66b88869b232a86e9c7dffc9485a2b70a7334294b103374e7c682639f2f8e.exe 1500 77c66b88869b232a86e9c7dffc9485a2b70a7334294b103374e7c682639f2f8e.exe 1500 77c66b88869b232a86e9c7dffc9485a2b70a7334294b103374e7c682639f2f8e.exe 1500 77c66b88869b232a86e9c7dffc9485a2b70a7334294b103374e7c682639f2f8e.exe 1500 77c66b88869b232a86e9c7dffc9485a2b70a7334294b103374e7c682639f2f8e.exe 1500 77c66b88869b232a86e9c7dffc9485a2b70a7334294b103374e7c682639f2f8e.exe 1500 77c66b88869b232a86e9c7dffc9485a2b70a7334294b103374e7c682639f2f8e.exe 1500 77c66b88869b232a86e9c7dffc9485a2b70a7334294b103374e7c682639f2f8e.exe 1500 77c66b88869b232a86e9c7dffc9485a2b70a7334294b103374e7c682639f2f8e.exe 1500 77c66b88869b232a86e9c7dffc9485a2b70a7334294b103374e7c682639f2f8e.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1500 77c66b88869b232a86e9c7dffc9485a2b70a7334294b103374e7c682639f2f8e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\77c66b88869b232a86e9c7dffc9485a2b70a7334294b103374e7c682639f2f8e.exe"C:\Users\Admin\AppData\Local\Temp\77c66b88869b232a86e9c7dffc9485a2b70a7334294b103374e7c682639f2f8e.exe"1⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1500