Analysis
-
max time kernel
298s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
20-09-2022 22:26
Static task
static1
Behavioral task
behavioral1
Sample
e0806ec8b5ef5a9d9c59bddbf6c946320c345a5d54ed5b808170fd7967f3889a.exe
Resource
win7-20220901-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral2
Sample
e0806ec8b5ef5a9d9c59bddbf6c946320c345a5d54ed5b808170fd7967f3889a.exe
Resource
win10-20220812-en
windows10-1703-x64
11 signatures
300 seconds
General
-
Target
e0806ec8b5ef5a9d9c59bddbf6c946320c345a5d54ed5b808170fd7967f3889a.exe
-
Size
3.8MB
-
MD5
102d3fa40d97527969092a10edf227fa
-
SHA1
5c80cf703216391fd2eabfd726c433d721d16e2d
-
SHA256
e0806ec8b5ef5a9d9c59bddbf6c946320c345a5d54ed5b808170fd7967f3889a
-
SHA512
fe3f974a7204bf0dc582cbc5fa274248fc3a493a7c538d59920f6ebc0777bda37d70d614ecdee05856aa00023e2904f7e130ee4ed4f3161035dc27a05f2f3201
-
SSDEEP
98304:gAaWLv99o6OGCyps4mFlHPqmHzUkUz3paWw:BLvOKWblV0wJ
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 19 IoCs
pid Process 852 e0806ec8b5ef5a9d9c59bddbf6c946320c345a5d54ed5b808170fd7967f3889a.exe 852 e0806ec8b5ef5a9d9c59bddbf6c946320c345a5d54ed5b808170fd7967f3889a.exe 852 e0806ec8b5ef5a9d9c59bddbf6c946320c345a5d54ed5b808170fd7967f3889a.exe 852 e0806ec8b5ef5a9d9c59bddbf6c946320c345a5d54ed5b808170fd7967f3889a.exe 852 e0806ec8b5ef5a9d9c59bddbf6c946320c345a5d54ed5b808170fd7967f3889a.exe 852 e0806ec8b5ef5a9d9c59bddbf6c946320c345a5d54ed5b808170fd7967f3889a.exe 852 e0806ec8b5ef5a9d9c59bddbf6c946320c345a5d54ed5b808170fd7967f3889a.exe 852 e0806ec8b5ef5a9d9c59bddbf6c946320c345a5d54ed5b808170fd7967f3889a.exe 852 e0806ec8b5ef5a9d9c59bddbf6c946320c345a5d54ed5b808170fd7967f3889a.exe 852 e0806ec8b5ef5a9d9c59bddbf6c946320c345a5d54ed5b808170fd7967f3889a.exe 852 e0806ec8b5ef5a9d9c59bddbf6c946320c345a5d54ed5b808170fd7967f3889a.exe 852 e0806ec8b5ef5a9d9c59bddbf6c946320c345a5d54ed5b808170fd7967f3889a.exe 852 e0806ec8b5ef5a9d9c59bddbf6c946320c345a5d54ed5b808170fd7967f3889a.exe 852 e0806ec8b5ef5a9d9c59bddbf6c946320c345a5d54ed5b808170fd7967f3889a.exe 852 e0806ec8b5ef5a9d9c59bddbf6c946320c345a5d54ed5b808170fd7967f3889a.exe 852 e0806ec8b5ef5a9d9c59bddbf6c946320c345a5d54ed5b808170fd7967f3889a.exe 852 e0806ec8b5ef5a9d9c59bddbf6c946320c345a5d54ed5b808170fd7967f3889a.exe 852 e0806ec8b5ef5a9d9c59bddbf6c946320c345a5d54ed5b808170fd7967f3889a.exe 852 e0806ec8b5ef5a9d9c59bddbf6c946320c345a5d54ed5b808170fd7967f3889a.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 852 e0806ec8b5ef5a9d9c59bddbf6c946320c345a5d54ed5b808170fd7967f3889a.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 852 e0806ec8b5ef5a9d9c59bddbf6c946320c345a5d54ed5b808170fd7967f3889a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0806ec8b5ef5a9d9c59bddbf6c946320c345a5d54ed5b808170fd7967f3889a.exe"C:\Users\Admin\AppData\Local\Temp\e0806ec8b5ef5a9d9c59bddbf6c946320c345a5d54ed5b808170fd7967f3889a.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:852