Analysis
-
max time kernel
83s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
11/09/2022, 17:56
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.GenericKD.50684290.19245.16771.exe
Resource
win7-20220812-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Trojan.GenericKD.50684290.19245.16771.exe
Resource
win10v2004-20220812-en
2 signatures
150 seconds
General
-
Target
SecuriteInfo.com.Trojan.GenericKD.50684290.19245.16771.exe
-
Size
19KB
-
MD5
2d34fa387cb4ece5b02b02f06c5286a9
-
SHA1
0fb6a4f93b5052b48ccf391a3142fbf43c6a88de
-
SHA256
73ef24e433584efdf0508ce6d6170007eb41520e8a2ae3ea2902ba3871b661df
-
SHA512
134ebafa3722e10065982b152ede02d531c811b9f78d44c2acb2cb20bee6fe92fce9519a3ec710ce73a14e1df7401482d7e5dbd7b8d28f8726fe9109121f10f4
-
SSDEEP
384:8zd3ZDDGdMob5IHvnfzZMbWuAMGADlPK9XdeZkNTLOrhNarOpdc:yfflIWiVQeZg2hNIOc
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3708 3940 WerFault.exe 33 -
Suspicious use of AdjustPrivilegeToken 21 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3940 SecuriteInfo.com.Trojan.GenericKD.50684290.19245.16771.exe Token: SeSecurityPrivilege 3940 SecuriteInfo.com.Trojan.GenericKD.50684290.19245.16771.exe Token: SeTakeOwnershipPrivilege 3940 SecuriteInfo.com.Trojan.GenericKD.50684290.19245.16771.exe Token: SeLoadDriverPrivilege 3940 SecuriteInfo.com.Trojan.GenericKD.50684290.19245.16771.exe Token: SeSystemProfilePrivilege 3940 SecuriteInfo.com.Trojan.GenericKD.50684290.19245.16771.exe Token: SeSystemtimePrivilege 3940 SecuriteInfo.com.Trojan.GenericKD.50684290.19245.16771.exe Token: SeProfSingleProcessPrivilege 3940 SecuriteInfo.com.Trojan.GenericKD.50684290.19245.16771.exe Token: SeIncBasePriorityPrivilege 3940 SecuriteInfo.com.Trojan.GenericKD.50684290.19245.16771.exe Token: SeCreatePagefilePrivilege 3940 SecuriteInfo.com.Trojan.GenericKD.50684290.19245.16771.exe Token: SeBackupPrivilege 3940 SecuriteInfo.com.Trojan.GenericKD.50684290.19245.16771.exe Token: SeRestorePrivilege 3940 SecuriteInfo.com.Trojan.GenericKD.50684290.19245.16771.exe Token: SeShutdownPrivilege 3940 SecuriteInfo.com.Trojan.GenericKD.50684290.19245.16771.exe Token: SeDebugPrivilege 3940 SecuriteInfo.com.Trojan.GenericKD.50684290.19245.16771.exe Token: SeSystemEnvironmentPrivilege 3940 SecuriteInfo.com.Trojan.GenericKD.50684290.19245.16771.exe Token: SeRemoteShutdownPrivilege 3940 SecuriteInfo.com.Trojan.GenericKD.50684290.19245.16771.exe Token: SeUndockPrivilege 3940 SecuriteInfo.com.Trojan.GenericKD.50684290.19245.16771.exe Token: SeManageVolumePrivilege 3940 SecuriteInfo.com.Trojan.GenericKD.50684290.19245.16771.exe Token: 33 3940 SecuriteInfo.com.Trojan.GenericKD.50684290.19245.16771.exe Token: 34 3940 SecuriteInfo.com.Trojan.GenericKD.50684290.19245.16771.exe Token: 35 3940 SecuriteInfo.com.Trojan.GenericKD.50684290.19245.16771.exe Token: 36 3940 SecuriteInfo.com.Trojan.GenericKD.50684290.19245.16771.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.50684290.19245.16771.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.50684290.19245.16771.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3940 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3940 -s 11162⤵
- Program crash
PID:3708
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 452 -p 3940 -ip 39401⤵PID:3420