Analysis
- max time kernel
135s - max time network
165s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
19/10/2022, 22:54
Static task
static1
Behavioral task
behavioral1
Sample
51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
150 seconds
General
- Target 51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe
- Size 817KB
- Sample221019-2vtcfacacm
- SHA256 51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8
- MD5 8256e956e7d81d34a4a17b568fe64300
- SHA1 fa239541dc8b0f1a1f25bb68c9bdff1bc0d00d6c
- SHA512 c885a50bb98f896b1ada2f736fc59b2095501e7c2b1f3467f1e453d430377a27fbc6a2a9a25fce60ca9b8a6272a040659f88ceff9c9a570bf3e5e1ee025c9755
- SSDEEP 24576:tWgkO2V00WFwrRV7K2CQPTVCDjs6dQPsN:tRkNV00WEV71fpaAq
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3280 set thread context of 4540 3280 51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe 78 - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3280 51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe 3280 51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe - Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4540 51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe Token: SeSecurityPrivilege 4540 51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe Token: SeTakeOwnershipPrivilege 4540 51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe Token: SeLoadDriverPrivilege 4540 51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe Token: SeSystemProfilePrivilege 4540 51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe Token: SeSystemtimePrivilege 4540 51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe Token: SeProfSingleProcessPrivilege 4540 51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe Token: SeIncBasePriorityPrivilege 4540 51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe Token: SeCreatePagefilePrivilege 4540 51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe Token: SeBackupPrivilege 4540 51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe Token: SeRestorePrivilege 4540 51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe Token: SeShutdownPrivilege 4540 51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe Token: SeDebugPrivilege 4540 51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe Token: SeSystemEnvironmentPrivilege 4540 51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe Token: SeChangeNotifyPrivilege 4540 51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe Token: SeRemoteShutdownPrivilege 4540 51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe Token: SeUndockPrivilege 4540 51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe Token: SeManageVolumePrivilege 4540 51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe Token: SeImpersonatePrivilege 4540 51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe Token: SeCreateGlobalPrivilege 4540 51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe Token: 33 4540 51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe Token: 34 4540 51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe Token: 35 4540 51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe Token: 36 4540 51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4540 51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 3280 wrote to memory of 4540 3280 51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe 78 PID 3280 wrote to memory of 4540 3280 51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe 78 PID 3280 wrote to memory of 4540 3280 51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe 78 PID 3280 wrote to memory of 4540 3280 51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe 78 PID 3280 wrote to memory of 4540 3280 51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe 78 PID 3280 wrote to memory of 4540 3280 51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe 78 PID 3280 wrote to memory of 4540 3280 51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe 78 PID 3280 wrote to memory of 4540 3280 51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe 78 PID 3280 wrote to memory of 4540 3280 51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe 78 PID 3280 wrote to memory of 4540 3280 51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe 78 PID 3280 wrote to memory of 4540 3280 51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe 78 PID 3280 wrote to memory of 4540 3280 51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe 78 PID 3280 wrote to memory of 4540 3280 51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe 78 PID 3280 wrote to memory of 4540 3280 51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe"C:\Users\Admin\AppData\Local\Temp\51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exeC:\Users\Admin\AppData\Local\Temp\51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4540
-