Analysis
-
max time kernel
151s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
09-06-2022 00:53
Static task
static1
Behavioral task
behavioral1
Sample
164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe
Resource
win7-20220414-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe
Resource
win10v2004-20220414-en
0 signatures
0 seconds
General
-
Target
164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe
-
Size
47KB
-
MD5
362c6b97511c613742d31ef8274f27c3
-
SHA1
4cd2e549e5c68052e0daa90093c3a032c82460bb
-
SHA256
164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281
-
SHA512
2c1765e903b44047eb9a5d85e198d1fca8a9675f3b3aa2c598b69ba6b88e461db9ab7674f6db970f0b60f15c83ce0f2d1dfcc8935481c082091912914c3fd1c7
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4156 164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe"C:\Users\Admin\AppData\Local\Temp\164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4156