Analysis
-
max time kernel
91s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 10:48
Behavioral task
behavioral1
Sample
e2e8b843d113f6827c5771f792e494a66249868ee99c7f0eb1324ad82d4701c5.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e2e8b843d113f6827c5771f792e494a66249868ee99c7f0eb1324ad82d4701c5.exe
Resource
win10v2004-20220901-en
General
-
Target
e2e8b843d113f6827c5771f792e494a66249868ee99c7f0eb1324ad82d4701c5.exe
-
Size
364KB
-
MD5
8cd2c64bc6b6232e8177c645397877b5
-
SHA1
11b6d548eb226b872c1cc4907e0b80ee1acd2041
-
SHA256
e2e8b843d113f6827c5771f792e494a66249868ee99c7f0eb1324ad82d4701c5
-
SHA512
c019851fe468641c607beeba64863237cd64ddc80fa44c81b6d86c7be73e58ecf00312fb85dc005a01b599090060f0ed8d739874499bfa2efefc64d1205aad88
-
SSDEEP
6144:mI09vpbAQ6nGavV0vu3a7tYECfwdzObXUHjIGINJgpJoPJwLfK6ormyo5o+SFWD0:69vpN6D0vkxwVCEDINOpJOAK3yy+SFk0
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/1316-132-0x0000000000400000-0x00000000004F4000-memory.dmp upx behavioral2/memory/1316-133-0x0000000000400000-0x00000000004F4000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
e2e8b843d113f6827c5771f792e494a66249868ee99c7f0eb1324ad82d4701c5.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation e2e8b843d113f6827c5771f792e494a66249868ee99c7f0eb1324ad82d4701c5.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
e2e8b843d113f6827c5771f792e494a66249868ee99c7f0eb1324ad82d4701c5.exedescription pid process Token: SeIncreaseQuotaPrivilege 1316 e2e8b843d113f6827c5771f792e494a66249868ee99c7f0eb1324ad82d4701c5.exe Token: SeSecurityPrivilege 1316 e2e8b843d113f6827c5771f792e494a66249868ee99c7f0eb1324ad82d4701c5.exe Token: SeTakeOwnershipPrivilege 1316 e2e8b843d113f6827c5771f792e494a66249868ee99c7f0eb1324ad82d4701c5.exe Token: SeLoadDriverPrivilege 1316 e2e8b843d113f6827c5771f792e494a66249868ee99c7f0eb1324ad82d4701c5.exe Token: SeSystemProfilePrivilege 1316 e2e8b843d113f6827c5771f792e494a66249868ee99c7f0eb1324ad82d4701c5.exe Token: SeSystemtimePrivilege 1316 e2e8b843d113f6827c5771f792e494a66249868ee99c7f0eb1324ad82d4701c5.exe Token: SeProfSingleProcessPrivilege 1316 e2e8b843d113f6827c5771f792e494a66249868ee99c7f0eb1324ad82d4701c5.exe Token: SeIncBasePriorityPrivilege 1316 e2e8b843d113f6827c5771f792e494a66249868ee99c7f0eb1324ad82d4701c5.exe Token: SeCreatePagefilePrivilege 1316 e2e8b843d113f6827c5771f792e494a66249868ee99c7f0eb1324ad82d4701c5.exe Token: SeBackupPrivilege 1316 e2e8b843d113f6827c5771f792e494a66249868ee99c7f0eb1324ad82d4701c5.exe Token: SeRestorePrivilege 1316 e2e8b843d113f6827c5771f792e494a66249868ee99c7f0eb1324ad82d4701c5.exe Token: SeShutdownPrivilege 1316 e2e8b843d113f6827c5771f792e494a66249868ee99c7f0eb1324ad82d4701c5.exe Token: SeDebugPrivilege 1316 e2e8b843d113f6827c5771f792e494a66249868ee99c7f0eb1324ad82d4701c5.exe Token: SeSystemEnvironmentPrivilege 1316 e2e8b843d113f6827c5771f792e494a66249868ee99c7f0eb1324ad82d4701c5.exe Token: SeChangeNotifyPrivilege 1316 e2e8b843d113f6827c5771f792e494a66249868ee99c7f0eb1324ad82d4701c5.exe Token: SeRemoteShutdownPrivilege 1316 e2e8b843d113f6827c5771f792e494a66249868ee99c7f0eb1324ad82d4701c5.exe Token: SeUndockPrivilege 1316 e2e8b843d113f6827c5771f792e494a66249868ee99c7f0eb1324ad82d4701c5.exe Token: SeManageVolumePrivilege 1316 e2e8b843d113f6827c5771f792e494a66249868ee99c7f0eb1324ad82d4701c5.exe Token: SeImpersonatePrivilege 1316 e2e8b843d113f6827c5771f792e494a66249868ee99c7f0eb1324ad82d4701c5.exe Token: SeCreateGlobalPrivilege 1316 e2e8b843d113f6827c5771f792e494a66249868ee99c7f0eb1324ad82d4701c5.exe Token: 33 1316 e2e8b843d113f6827c5771f792e494a66249868ee99c7f0eb1324ad82d4701c5.exe Token: 34 1316 e2e8b843d113f6827c5771f792e494a66249868ee99c7f0eb1324ad82d4701c5.exe Token: 35 1316 e2e8b843d113f6827c5771f792e494a66249868ee99c7f0eb1324ad82d4701c5.exe Token: 36 1316 e2e8b843d113f6827c5771f792e494a66249868ee99c7f0eb1324ad82d4701c5.exe