Analysis
-
max time kernel
136s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
22-06-2022 08:13
Static task
static1
Behavioral task
behavioral1
Sample
2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe
-
Size
404KB
-
MD5
527b7f44376120b799c6a45a20b236a7
-
SHA1
11b74d8147b67d05192aa44bde711f5ce355f638
-
SHA256
2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f
-
SHA512
1b19afa52faa7eb393d66fd2b6ebe7f0f2430aa41cfb68266f163d2953b7bbb0bfa2e9e4f95772638f012ca11aeee1f299ff152ec4674944909daad75c7f33c7
Score
6/10
Malware Config
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Modifies registry class 1 IoCs
Processes:
2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_Classes\Local Settings 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exedescription pid Process Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe Token: SeSecurityPrivilege 1932 2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f.exe