Analysis
- max time kernel
163s - max time network
182s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
19/10/2022, 16:21
Static task
static1
Behavioral task
behavioral1
Sample
f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
General
- Target f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe
- Size 743KB
- Sample221019-tt12wsfef6
- SHA256 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5
- MD5 a0f9e1b147653c297860cb860491f430
- SHA1 9851240dec312c86d0daf117e5186eae72288397
- SHA512 d5936531a45b5c7f95aa77e07f416eedbcf3b1e87e0a3373918fb14f1022a2f6478380d3dc10ff3047e29392bab9944bb5ae43e819e35327c57245a27299f375
- SSDEEP 12288:rphltQBhlIyUjT9Aju9hMH9PzhmykcXQsVzFP/Y1Ki9kmiOb7usColpPNcDtHR44:UhlsejG+H5VxA2FP/Yvk7OXus7BcDtHH
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3980 set thread context of 1688 3980 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe 79 - Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeSecurityPrivilege 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeTakeOwnershipPrivilege 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeLoadDriverPrivilege 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeSystemProfilePrivilege 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeSystemtimePrivilege 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeProfSingleProcessPrivilege 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeIncBasePriorityPrivilege 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeCreatePagefilePrivilege 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeBackupPrivilege 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeRestorePrivilege 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeShutdownPrivilege 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeDebugPrivilege 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeSystemEnvironmentPrivilege 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeChangeNotifyPrivilege 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeRemoteShutdownPrivilege 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeUndockPrivilege 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeManageVolumePrivilege 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeImpersonatePrivilege 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: SeCreateGlobalPrivilege 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: 33 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: 34 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: 35 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe Token: 36 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1688 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 3980 wrote to memory of 1688 3980 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe 79 PID 3980 wrote to memory of 1688 3980 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe 79 PID 3980 wrote to memory of 1688 3980 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe 79 PID 3980 wrote to memory of 1688 3980 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe 79 PID 3980 wrote to memory of 1688 3980 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe 79 PID 3980 wrote to memory of 1688 3980 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe 79 PID 3980 wrote to memory of 1688 3980 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe 79 PID 3980 wrote to memory of 1688 3980 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe 79 PID 3980 wrote to memory of 1688 3980 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe 79 PID 3980 wrote to memory of 1688 3980 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe 79 PID 3980 wrote to memory of 1688 3980 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe 79 PID 3980 wrote to memory of 1688 3980 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe 79 PID 3980 wrote to memory of 1688 3980 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe 79 PID 3980 wrote to memory of 1688 3980 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe"C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exeC:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1688
-