Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30/09/2022, 20:08
Behavioral task
behavioral1
Sample
bF3n.exe
Resource
win7-20220812-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
bF3n.exe
Resource
win10v2004-20220901-en
2 signatures
150 seconds
General
-
Target
bF3n.exe
-
Size
32KB
-
MD5
53e55d9dff8b5b2d1027126eb4bc2e41
-
SHA1
084d245da2e89428df88f03f9053ae0e9a07a740
-
SHA256
7a6c5815545f2172e0717732eb817b464b324c7a218b85266d5ccfdb62423cda
-
SHA512
c5f67e0c6e016b6c6dc19562e165dac57322117b43054f4b19c706271e44c27e87c8cdc2788ee4877fdc5d4d84c989ee29c8c711d70bea18b36d60e2ba70dd48
-
SSDEEP
384:+O0bUe5XB4e0XuOlCANuiEO0YaVWTOtTUFQqzFjObbc:+fT9ButYguiEYCtbc
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeDebugPrivilege 1608 bF3n.exe Token: 33 1608 bF3n.exe Token: SeIncBasePriorityPrivilege 1608 bF3n.exe Token: 33 1608 bF3n.exe Token: SeIncBasePriorityPrivilege 1608 bF3n.exe Token: 33 1608 bF3n.exe Token: SeIncBasePriorityPrivilege 1608 bF3n.exe Token: 33 1608 bF3n.exe Token: SeIncBasePriorityPrivilege 1608 bF3n.exe Token: 33 1608 bF3n.exe Token: SeIncBasePriorityPrivilege 1608 bF3n.exe Token: 33 1608 bF3n.exe Token: SeIncBasePriorityPrivilege 1608 bF3n.exe Token: 33 1608 bF3n.exe Token: SeIncBasePriorityPrivilege 1608 bF3n.exe Token: 33 1608 bF3n.exe Token: SeIncBasePriorityPrivilege 1608 bF3n.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1608 wrote to memory of 1980 1608 bF3n.exe 27 PID 1608 wrote to memory of 1980 1608 bF3n.exe 27 PID 1608 wrote to memory of 1980 1608 bF3n.exe 27 PID 1608 wrote to memory of 1980 1608 bF3n.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\bF3n.exe"C:\Users\Admin\AppData\Local\Temp\bF3n.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\SysWOW64\cmd.execmd.exe /C Y /N /D Y /T 1 & Del "C:\Users\Admin\AppData\Local\Temp\bF3n.exe"2⤵PID:1980
-