Analysis
-
max time kernel
158s -
max time network
169s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 18:39
Static task
static1
Behavioral task
behavioral1
Sample
e410c4b80aec7d583d1e1fdab7072cc0047aa0ebd433df8a356b57c22ca8d0af.exe
Resource
win7-20220812-en
windows7-x64
4 signatures
150 seconds
General
-
Target
e410c4b80aec7d583d1e1fdab7072cc0047aa0ebd433df8a356b57c22ca8d0af.exe
-
Size
685KB
-
MD5
bdc4a8ef0f9adbd1253b48aba70167ae
-
SHA1
6b081505de57ec8668ce7b63873510b1f024551a
-
SHA256
e410c4b80aec7d583d1e1fdab7072cc0047aa0ebd433df8a356b57c22ca8d0af
-
SHA512
a62c68896d885e0aed2821b26133358b082289151f04f069507f021eb34876e760f1d9ac9a1ffdf03511735845a187a5fd775216b7dedb15eeb2a47efef9e930
-
SSDEEP
12288:5KsrW5aEx8uX+TJ8tXYk4dHct2CAKsw1UBKhm2m+dLPwe4gMSGEj0xLpUk:AsrI8uAXZct2zKtUBKAn+LPwePGV
Malware Config
Signatures
-
Processes:
e410c4b80aec7d583d1e1fdab7072cc0047aa0ebd433df8a356b57c22ca8d0af.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA e410c4b80aec7d583d1e1fdab7072cc0047aa0ebd433df8a356b57c22ca8d0af.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
e410c4b80aec7d583d1e1fdab7072cc0047aa0ebd433df8a356b57c22ca8d0af.exedescription pid process Token: SeDebugPrivilege 3312 e410c4b80aec7d583d1e1fdab7072cc0047aa0ebd433df8a356b57c22ca8d0af.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
e410c4b80aec7d583d1e1fdab7072cc0047aa0ebd433df8a356b57c22ca8d0af.exepid process 3312 e410c4b80aec7d583d1e1fdab7072cc0047aa0ebd433df8a356b57c22ca8d0af.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e410c4b80aec7d583d1e1fdab7072cc0047aa0ebd433df8a356b57c22ca8d0af.exe"C:\Users\Admin\AppData\Local\Temp\e410c4b80aec7d583d1e1fdab7072cc0047aa0ebd433df8a356b57c22ca8d0af.exe"1⤵
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3312