Analysis
-
max time kernel
123s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24/11/2022, 12:16
Static task
static1
Behavioral task
behavioral1
Sample
7f8c7f9602387d52335f9ad13e9e56766fef6d9568ccd1bff93b45f618707b8b.exe
Resource
win7-20220901-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
7f8c7f9602387d52335f9ad13e9e56766fef6d9568ccd1bff93b45f618707b8b.exe
Resource
win10v2004-20220812-en
3 signatures
150 seconds
General
-
Target
7f8c7f9602387d52335f9ad13e9e56766fef6d9568ccd1bff93b45f618707b8b.exe
-
Size
202KB
-
MD5
e3e9e8c89e1ae25ba9e77003ee677693
-
SHA1
2958964fd5dbc6a74c61912ef012ed50c2d95009
-
SHA256
7f8c7f9602387d52335f9ad13e9e56766fef6d9568ccd1bff93b45f618707b8b
-
SHA512
a5122f8c6c7133f232dc31703234c40674d3ad8d69ff6494f24cafea40aeb065fc9e207feef03c802b2bafa529c5b05d90979173a440c4461e3ac7ae3009d49b
-
SSDEEP
3072:WnMxw7tQC61AJoOn4sQkCW8Yr40NTajA9oAA2a6h:WUw7W7L0t1a6h
Score
4/10
Malware Config
Signatures
-
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\AutocloseConfig.ini 7f8c7f9602387d52335f9ad13e9e56766fef6d9568ccd1bff93b45f618707b8b.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 4084 7f8c7f9602387d52335f9ad13e9e56766fef6d9568ccd1bff93b45f618707b8b.exe Token: SeIncBasePriorityPrivilege 4084 7f8c7f9602387d52335f9ad13e9e56766fef6d9568ccd1bff93b45f618707b8b.exe Token: 33 4084 7f8c7f9602387d52335f9ad13e9e56766fef6d9568ccd1bff93b45f618707b8b.exe Token: SeIncBasePriorityPrivilege 4084 7f8c7f9602387d52335f9ad13e9e56766fef6d9568ccd1bff93b45f618707b8b.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4084 7f8c7f9602387d52335f9ad13e9e56766fef6d9568ccd1bff93b45f618707b8b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f8c7f9602387d52335f9ad13e9e56766fef6d9568ccd1bff93b45f618707b8b.exe"C:\Users\Admin\AppData\Local\Temp\7f8c7f9602387d52335f9ad13e9e56766fef6d9568ccd1bff93b45f618707b8b.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4084