Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 19:52
Static task
static1
Behavioral task
behavioral1
Sample
c66056c8b44fa607405257ee4d62e3501b6813ba89e6cfe0b02ffc34477c771d.exe
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
c66056c8b44fa607405257ee4d62e3501b6813ba89e6cfe0b02ffc34477c771d.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
c66056c8b44fa607405257ee4d62e3501b6813ba89e6cfe0b02ffc34477c771d.exe
-
Size
992KB
-
MD5
97c4fad6f0d8f885f573bd33206b107b
-
SHA1
4e16d4ed0e94bdf912c3b000299e649d7819a457
-
SHA256
c66056c8b44fa607405257ee4d62e3501b6813ba89e6cfe0b02ffc34477c771d
-
SHA512
5fc12ae2e535bbfe34bf43f72c63a6ee87c6b41f69650f18c636836cb371e5f1f4baa9a326f9b17d6745ef740c82d93b08704b3f819db19fbd0f71286c8a93f1
-
SSDEEP
24576:emgKbxMe5jgHDLgPjlcrR/TR4pJbe1idbUy:e1eUfgPxWR4zbHR
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4704-132-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4704-133-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4704-134-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4704-136-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4704-138-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4704-140-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4704-142-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4704-144-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4704-146-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4704-148-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4704-150-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4704-152-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4704-154-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4704-156-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4704-158-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4704-160-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4704-162-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4704-164-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4704-166-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4704-168-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4704-170-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4704-172-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4704-174-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4704-175-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4704-176-0x0000000010000000-0x000000001003E000-memory.dmp upx -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeRestorePrivilege 4704 c66056c8b44fa607405257ee4d62e3501b6813ba89e6cfe0b02ffc34477c771d.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4704 c66056c8b44fa607405257ee4d62e3501b6813ba89e6cfe0b02ffc34477c771d.exe 4704 c66056c8b44fa607405257ee4d62e3501b6813ba89e6cfe0b02ffc34477c771d.exe 4704 c66056c8b44fa607405257ee4d62e3501b6813ba89e6cfe0b02ffc34477c771d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c66056c8b44fa607405257ee4d62e3501b6813ba89e6cfe0b02ffc34477c771d.exe"C:\Users\Admin\AppData\Local\Temp\c66056c8b44fa607405257ee4d62e3501b6813ba89e6cfe0b02ffc34477c771d.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4704