Analysis
- max time kernel
108s - max time network
177s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system - submitted
14/10/2022, 10:02
Behavioral task
behavioral1
Sample
558db319558052d6d99d1f590b65fb7082f13dee01e9bb933bd5f46c7ccefcfe.exe
Resource
win7-20220812-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
558db319558052d6d99d1f590b65fb7082f13dee01e9bb933bd5f46c7ccefcfe.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
1 signatures
150 seconds
General
- Target 558db319558052d6d99d1f590b65fb7082f13dee01e9bb933bd5f46c7ccefcfe.exe
- Size 659KB
- Sample221014-l2v7lsadd6
- SHA256 558db319558052d6d99d1f590b65fb7082f13dee01e9bb933bd5f46c7ccefcfe
- MD5 6191bbe36c8bd27939273201e89f3d70
- SHA1 61a543bdd19599a821a7bb3853ba936d22b1f5b9
- SHA512 a31c45cabbf1f00a99808e2facec44ff6fe1e68fff12c60afea9f54a5d33e6d29ed9392d63562185114464eaad253b1e83f68efe5981cd24b705c83b12d26db1
- SSDEEP 12288:eXhpvNWw276S/DuoeFcfbmiJ99VPhYR5MTSHvLenELrWv1lZw4JuMkMh/fy452U:AnAw2WWeFcfbP9VPSPMTSPL/rWvzq4JX
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 5052 558db319558052d6d99d1f590b65fb7082f13dee01e9bb933bd5f46c7ccefcfe.exe Token: SeSecurityPrivilege 5052 558db319558052d6d99d1f590b65fb7082f13dee01e9bb933bd5f46c7ccefcfe.exe Token: SeTakeOwnershipPrivilege 5052 558db319558052d6d99d1f590b65fb7082f13dee01e9bb933bd5f46c7ccefcfe.exe Token: SeLoadDriverPrivilege 5052 558db319558052d6d99d1f590b65fb7082f13dee01e9bb933bd5f46c7ccefcfe.exe Token: SeSystemProfilePrivilege 5052 558db319558052d6d99d1f590b65fb7082f13dee01e9bb933bd5f46c7ccefcfe.exe Token: SeSystemtimePrivilege 5052 558db319558052d6d99d1f590b65fb7082f13dee01e9bb933bd5f46c7ccefcfe.exe Token: SeProfSingleProcessPrivilege 5052 558db319558052d6d99d1f590b65fb7082f13dee01e9bb933bd5f46c7ccefcfe.exe Token: SeIncBasePriorityPrivilege 5052 558db319558052d6d99d1f590b65fb7082f13dee01e9bb933bd5f46c7ccefcfe.exe Token: SeCreatePagefilePrivilege 5052 558db319558052d6d99d1f590b65fb7082f13dee01e9bb933bd5f46c7ccefcfe.exe Token: SeBackupPrivilege 5052 558db319558052d6d99d1f590b65fb7082f13dee01e9bb933bd5f46c7ccefcfe.exe Token: SeRestorePrivilege 5052 558db319558052d6d99d1f590b65fb7082f13dee01e9bb933bd5f46c7ccefcfe.exe Token: SeShutdownPrivilege 5052 558db319558052d6d99d1f590b65fb7082f13dee01e9bb933bd5f46c7ccefcfe.exe Token: SeDebugPrivilege 5052 558db319558052d6d99d1f590b65fb7082f13dee01e9bb933bd5f46c7ccefcfe.exe Token: SeSystemEnvironmentPrivilege 5052 558db319558052d6d99d1f590b65fb7082f13dee01e9bb933bd5f46c7ccefcfe.exe Token: SeChangeNotifyPrivilege 5052 558db319558052d6d99d1f590b65fb7082f13dee01e9bb933bd5f46c7ccefcfe.exe Token: SeRemoteShutdownPrivilege 5052 558db319558052d6d99d1f590b65fb7082f13dee01e9bb933bd5f46c7ccefcfe.exe Token: SeUndockPrivilege 5052 558db319558052d6d99d1f590b65fb7082f13dee01e9bb933bd5f46c7ccefcfe.exe Token: SeManageVolumePrivilege 5052 558db319558052d6d99d1f590b65fb7082f13dee01e9bb933bd5f46c7ccefcfe.exe Token: SeImpersonatePrivilege 5052 558db319558052d6d99d1f590b65fb7082f13dee01e9bb933bd5f46c7ccefcfe.exe Token: SeCreateGlobalPrivilege 5052 558db319558052d6d99d1f590b65fb7082f13dee01e9bb933bd5f46c7ccefcfe.exe Token: 33 5052 558db319558052d6d99d1f590b65fb7082f13dee01e9bb933bd5f46c7ccefcfe.exe Token: 34 5052 558db319558052d6d99d1f590b65fb7082f13dee01e9bb933bd5f46c7ccefcfe.exe Token: 35 5052 558db319558052d6d99d1f590b65fb7082f13dee01e9bb933bd5f46c7ccefcfe.exe Token: 36 5052 558db319558052d6d99d1f590b65fb7082f13dee01e9bb933bd5f46c7ccefcfe.exe