Analysis
-
max time kernel
150s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
24-07-2022 01:58
Static task
static1
Behavioral task
behavioral1
Sample
5a13433353954864e671bf5d8ec247da4fc94f89d81469e5e13993b71125a326.exe
Resource
win7-20220718-en
windows7-x64
3 signatures
150 seconds
General
-
Target
5a13433353954864e671bf5d8ec247da4fc94f89d81469e5e13993b71125a326.exe
-
Size
1002KB
-
MD5
69da18e4bcdad84f3233a2953f7aaf98
-
SHA1
7a7b87d3dcede30f192e3929b0412a89c9da58ee
-
SHA256
5a13433353954864e671bf5d8ec247da4fc94f89d81469e5e13993b71125a326
-
SHA512
d995c316f9513a0998e8154077bc01859cc271fb9aa3f1493714da0cd1d776ac645c9eca6dc1511ef1093031fc9fa07025064d49ebc4d99c9f4cbe69fbb32f29
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
5a13433353954864e671bf5d8ec247da4fc94f89d81469e5e13993b71125a326.exepid process 1648 5a13433353954864e671bf5d8ec247da4fc94f89d81469e5e13993b71125a326.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
5a13433353954864e671bf5d8ec247da4fc94f89d81469e5e13993b71125a326.exepid process 1648 5a13433353954864e671bf5d8ec247da4fc94f89d81469e5e13993b71125a326.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
5a13433353954864e671bf5d8ec247da4fc94f89d81469e5e13993b71125a326.exedescription pid process Token: SeDebugPrivilege 1648 5a13433353954864e671bf5d8ec247da4fc94f89d81469e5e13993b71125a326.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a13433353954864e671bf5d8ec247da4fc94f89d81469e5e13993b71125a326.exe"C:\Users\Admin\AppData\Local\Temp\5a13433353954864e671bf5d8ec247da4fc94f89d81469e5e13993b71125a326.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1648