Analysis
-
max time kernel
152s -
max time network
180s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 21:18
Static task
static1
Behavioral task
behavioral1
Sample
ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2.exe
Resource
win10v2004-20221111-en
General
-
Target
ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2.exe
-
Size
2.4MB
-
MD5
998f77aeeafe948afd2332dc3813b0d0
-
SHA1
873ca6cb898f720a41315f42c359a5b3755116c5
-
SHA256
ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2
-
SHA512
12fae2c27b87d4e22b965fac8bd75b425fc2d0c803dfd2f006957a30ddb4e20edd6fc5024269cbe076005497e307cc8f7a1a60d0e2a76fc3341db94277c61ec0
-
SSDEEP
24576:lMOO6fBzJuMiuaU6hhkX54k5nvVeBeCQiqElvMQKVNsDr+ClG82Zkw3BOTvEeEZx:Cn6xnvVeBKSMnVNqlG6VTceWrQA
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4348 2124 WerFault.exe ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2.exedescription pid process Token: 1 2124 ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2.exe Token: SeCreateTokenPrivilege 2124 ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2.exe Token: SeAssignPrimaryTokenPrivilege 2124 ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2.exe Token: SeLockMemoryPrivilege 2124 ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2.exe Token: SeIncreaseQuotaPrivilege 2124 ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2.exe Token: SeMachineAccountPrivilege 2124 ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2.exe Token: SeTcbPrivilege 2124 ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2.exe Token: SeSecurityPrivilege 2124 ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2.exe Token: SeTakeOwnershipPrivilege 2124 ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2.exe Token: SeLoadDriverPrivilege 2124 ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2.exe Token: SeSystemProfilePrivilege 2124 ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2.exe Token: SeSystemtimePrivilege 2124 ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2.exe Token: SeProfSingleProcessPrivilege 2124 ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2.exe Token: SeIncBasePriorityPrivilege 2124 ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2.exe Token: SeCreatePagefilePrivilege 2124 ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2.exe Token: SeCreatePermanentPrivilege 2124 ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2.exe Token: SeBackupPrivilege 2124 ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2.exe Token: SeRestorePrivilege 2124 ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2.exe Token: SeShutdownPrivilege 2124 ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2.exe Token: SeDebugPrivilege 2124 ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2.exe Token: SeAuditPrivilege 2124 ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2.exe Token: SeSystemEnvironmentPrivilege 2124 ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2.exe Token: SeChangeNotifyPrivilege 2124 ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2.exe Token: SeRemoteShutdownPrivilege 2124 ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2.exe Token: SeUndockPrivilege 2124 ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2.exe Token: SeSyncAgentPrivilege 2124 ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2.exe Token: SeEnableDelegationPrivilege 2124 ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2.exe Token: SeManageVolumePrivilege 2124 ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2.exe Token: SeImpersonatePrivilege 2124 ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2.exe Token: SeCreateGlobalPrivilege 2124 ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2.exe Token: 31 2124 ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2.exe Token: 32 2124 ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2.exe Token: 33 2124 ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2.exe Token: 34 2124 ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2.exe Token: 35 2124 ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2.exepid process 2124 ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2.exe 2124 ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2.exe 2124 ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2.exe 2124 ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2.exe"C:\Users\Admin\AppData\Local\Temp\ade6caef83a8173516177690439852cfdc92e20bbcf741a9f6f851e9c8aacbe2.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 17202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2124 -ip 21241⤵