Analysis
-
max time kernel
154s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19/10/2022, 16:21
Static task
static1
Behavioral task
behavioral1
Sample
f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe
Resource
win7-20220812-en
5 signatures
150 seconds
General
-
Target
f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe
-
Size
743KB
-
MD5
a0f9e1b147653c297860cb860491f430
-
SHA1
9851240dec312c86d0daf117e5186eae72288397
-
SHA256
f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5
-
SHA512
d5936531a45b5c7f95aa77e07f416eedbcf3b1e87e0a3373918fb14f1022a2f6478380d3dc10ff3047e29392bab9944bb5ae43e819e35327c57245a27299f375
-
SSDEEP
12288:rphltQBhlIyUjT9Aju9hMH9PzhmykcXQsVzFP/Y1Ki9kmiOb7usColpPNcDtHR44:UhlsejG+H5VxA2FP/Yvk7OXus7BcDtHH
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2016 set thread context of 916 2016 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe 28 -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 916 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeSecurityPrivilege 916 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeTakeOwnershipPrivilege 916 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeLoadDriverPrivilege 916 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeSystemProfilePrivilege 916 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeSystemtimePrivilege 916 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeProfSingleProcessPrivilege 916 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeIncBasePriorityPrivilege 916 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeCreatePagefilePrivilege 916 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeBackupPrivilege 916 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeRestorePrivilege 916 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeShutdownPrivilege 916 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeDebugPrivilege 916 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeSystemEnvironmentPrivilege 916 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeChangeNotifyPrivilege 916 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeRemoteShutdownPrivilege 916 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeUndockPrivilege 916 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeManageVolumePrivilege 916 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeImpersonatePrivilege 916 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeCreateGlobalPrivilege 916 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: 33 916 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: 34 916 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: 35 916 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 916 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2016 wrote to memory of 916 2016 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe 28 PID 2016 wrote to memory of 916 2016 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe 28 PID 2016 wrote to memory of 916 2016 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe 28 PID 2016 wrote to memory of 916 2016 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe 28 PID 2016 wrote to memory of 916 2016 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe 28 PID 2016 wrote to memory of 916 2016 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe 28 PID 2016 wrote to memory of 916 2016 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe 28 PID 2016 wrote to memory of 916 2016 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe 28 PID 2016 wrote to memory of 916 2016 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe 28 PID 2016 wrote to memory of 916 2016 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe 28 PID 2016 wrote to memory of 916 2016 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe 28 PID 2016 wrote to memory of 916 2016 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe 28 PID 2016 wrote to memory of 916 2016 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe"C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exeC:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:916
-