Analysis
-
max time kernel
163s -
max time network
182s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
19/10/2022, 16:21
Static task
static1
Behavioral task
behavioral1
Sample
f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe
Resource
win7-20220812-en
5 signatures
150 seconds
General
-
Target
f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe
-
Size
743KB
-
MD5
a0f9e1b147653c297860cb860491f430
-
SHA1
9851240dec312c86d0daf117e5186eae72288397
-
SHA256
f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5
-
SHA512
d5936531a45b5c7f95aa77e07f416eedbcf3b1e87e0a3373918fb14f1022a2f6478380d3dc10ff3047e29392bab9944bb5ae43e819e35327c57245a27299f375
-
SSDEEP
12288:rphltQBhlIyUjT9Aju9hMH9PzhmykcXQsVzFP/Y1Ki9kmiOb7usColpPNcDtHR44:UhlsejG+H5VxA2FP/Yvk7OXus7BcDtHH
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3980 set thread context of 1688 3980 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe 79 -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeSecurityPrivilege 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeTakeOwnershipPrivilege 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeLoadDriverPrivilege 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeSystemProfilePrivilege 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeSystemtimePrivilege 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeProfSingleProcessPrivilege 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeIncBasePriorityPrivilege 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeCreatePagefilePrivilege 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeBackupPrivilege 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeRestorePrivilege 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeShutdownPrivilege 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeDebugPrivilege 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeSystemEnvironmentPrivilege 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeChangeNotifyPrivilege 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeRemoteShutdownPrivilege 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeUndockPrivilege 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeManageVolumePrivilege 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeImpersonatePrivilege 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeCreateGlobalPrivilege 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: 33 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: 34 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: 35 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: 36 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 3980 wrote to memory of 1688 3980 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe 79 PID 3980 wrote to memory of 1688 3980 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe 79 PID 3980 wrote to memory of 1688 3980 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe 79 PID 3980 wrote to memory of 1688 3980 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe 79 PID 3980 wrote to memory of 1688 3980 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe 79 PID 3980 wrote to memory of 1688 3980 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe 79 PID 3980 wrote to memory of 1688 3980 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe 79 PID 3980 wrote to memory of 1688 3980 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe 79 PID 3980 wrote to memory of 1688 3980 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe 79 PID 3980 wrote to memory of 1688 3980 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe 79 PID 3980 wrote to memory of 1688 3980 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe 79 PID 3980 wrote to memory of 1688 3980 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe 79 PID 3980 wrote to memory of 1688 3980 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe 79 PID 3980 wrote to memory of 1688 3980 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe"C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exeC:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1688
-