Analysis
-
max time kernel
174s -
max time network
86s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25/11/2022, 11:43
Behavioral task
behavioral1
Sample
2ee1cfe47fb4e47f6d83cb3cc9a5d54a05d91e7a7f9ccdb06ac16510e1cf3301.exe
Resource
win7-20221111-en
windows7-x64
5 signatures
150 seconds
General
-
Target
2ee1cfe47fb4e47f6d83cb3cc9a5d54a05d91e7a7f9ccdb06ac16510e1cf3301.exe
-
Size
649KB
-
MD5
8db553afe32ba9cbfbdbb97f65f3866c
-
SHA1
742552f5c4c3599c480931c68e12a6c4f64fd6ab
-
SHA256
2ee1cfe47fb4e47f6d83cb3cc9a5d54a05d91e7a7f9ccdb06ac16510e1cf3301
-
SHA512
0cb6076b67c658afd5ee589361732e6363466f925bedcb4d775380f3d9d170ae30c8fd2505c770831adf0e1df06e1968cb41687532913c40e99bc938cde4404e
-
SSDEEP
12288:7k0QVlhmPojAPTMEsUTg0oChO/Q2JbsbjPbN5qhRTtYe3f+Iw86k/9/+k:w0QRWoJEfg0oChGdJQbjPbNW5tYeP+Gl
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2036 set thread context of 956 2036 2ee1cfe47fb4e47f6d83cb3cc9a5d54a05d91e7a7f9ccdb06ac16510e1cf3301.exe 28 -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2036 2ee1cfe47fb4e47f6d83cb3cc9a5d54a05d91e7a7f9ccdb06ac16510e1cf3301.exe Token: SeSecurityPrivilege 2036 2ee1cfe47fb4e47f6d83cb3cc9a5d54a05d91e7a7f9ccdb06ac16510e1cf3301.exe Token: SeTakeOwnershipPrivilege 2036 2ee1cfe47fb4e47f6d83cb3cc9a5d54a05d91e7a7f9ccdb06ac16510e1cf3301.exe Token: SeLoadDriverPrivilege 2036 2ee1cfe47fb4e47f6d83cb3cc9a5d54a05d91e7a7f9ccdb06ac16510e1cf3301.exe Token: SeSystemProfilePrivilege 2036 2ee1cfe47fb4e47f6d83cb3cc9a5d54a05d91e7a7f9ccdb06ac16510e1cf3301.exe Token: SeSystemtimePrivilege 2036 2ee1cfe47fb4e47f6d83cb3cc9a5d54a05d91e7a7f9ccdb06ac16510e1cf3301.exe Token: SeProfSingleProcessPrivilege 2036 2ee1cfe47fb4e47f6d83cb3cc9a5d54a05d91e7a7f9ccdb06ac16510e1cf3301.exe Token: SeIncBasePriorityPrivilege 2036 2ee1cfe47fb4e47f6d83cb3cc9a5d54a05d91e7a7f9ccdb06ac16510e1cf3301.exe Token: SeCreatePagefilePrivilege 2036 2ee1cfe47fb4e47f6d83cb3cc9a5d54a05d91e7a7f9ccdb06ac16510e1cf3301.exe Token: SeBackupPrivilege 2036 2ee1cfe47fb4e47f6d83cb3cc9a5d54a05d91e7a7f9ccdb06ac16510e1cf3301.exe Token: SeRestorePrivilege 2036 2ee1cfe47fb4e47f6d83cb3cc9a5d54a05d91e7a7f9ccdb06ac16510e1cf3301.exe Token: SeShutdownPrivilege 2036 2ee1cfe47fb4e47f6d83cb3cc9a5d54a05d91e7a7f9ccdb06ac16510e1cf3301.exe Token: SeDebugPrivilege 2036 2ee1cfe47fb4e47f6d83cb3cc9a5d54a05d91e7a7f9ccdb06ac16510e1cf3301.exe Token: SeSystemEnvironmentPrivilege 2036 2ee1cfe47fb4e47f6d83cb3cc9a5d54a05d91e7a7f9ccdb06ac16510e1cf3301.exe Token: SeChangeNotifyPrivilege 2036 2ee1cfe47fb4e47f6d83cb3cc9a5d54a05d91e7a7f9ccdb06ac16510e1cf3301.exe Token: SeRemoteShutdownPrivilege 2036 2ee1cfe47fb4e47f6d83cb3cc9a5d54a05d91e7a7f9ccdb06ac16510e1cf3301.exe Token: SeUndockPrivilege 2036 2ee1cfe47fb4e47f6d83cb3cc9a5d54a05d91e7a7f9ccdb06ac16510e1cf3301.exe Token: SeManageVolumePrivilege 2036 2ee1cfe47fb4e47f6d83cb3cc9a5d54a05d91e7a7f9ccdb06ac16510e1cf3301.exe Token: SeImpersonatePrivilege 2036 2ee1cfe47fb4e47f6d83cb3cc9a5d54a05d91e7a7f9ccdb06ac16510e1cf3301.exe Token: SeCreateGlobalPrivilege 2036 2ee1cfe47fb4e47f6d83cb3cc9a5d54a05d91e7a7f9ccdb06ac16510e1cf3301.exe Token: 33 2036 2ee1cfe47fb4e47f6d83cb3cc9a5d54a05d91e7a7f9ccdb06ac16510e1cf3301.exe Token: 34 2036 2ee1cfe47fb4e47f6d83cb3cc9a5d54a05d91e7a7f9ccdb06ac16510e1cf3301.exe Token: 35 2036 2ee1cfe47fb4e47f6d83cb3cc9a5d54a05d91e7a7f9ccdb06ac16510e1cf3301.exe Token: SeIncreaseQuotaPrivilege 956 iexplore.exe Token: SeSecurityPrivilege 956 iexplore.exe Token: SeTakeOwnershipPrivilege 956 iexplore.exe Token: SeLoadDriverPrivilege 956 iexplore.exe Token: SeSystemProfilePrivilege 956 iexplore.exe Token: SeSystemtimePrivilege 956 iexplore.exe Token: SeProfSingleProcessPrivilege 956 iexplore.exe Token: SeIncBasePriorityPrivilege 956 iexplore.exe Token: SeCreatePagefilePrivilege 956 iexplore.exe Token: SeBackupPrivilege 956 iexplore.exe Token: SeRestorePrivilege 956 iexplore.exe Token: SeShutdownPrivilege 956 iexplore.exe Token: SeDebugPrivilege 956 iexplore.exe Token: SeSystemEnvironmentPrivilege 956 iexplore.exe Token: SeChangeNotifyPrivilege 956 iexplore.exe Token: SeRemoteShutdownPrivilege 956 iexplore.exe Token: SeUndockPrivilege 956 iexplore.exe Token: SeManageVolumePrivilege 956 iexplore.exe Token: SeImpersonatePrivilege 956 iexplore.exe Token: SeCreateGlobalPrivilege 956 iexplore.exe Token: 33 956 iexplore.exe Token: 34 956 iexplore.exe Token: 35 956 iexplore.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 956 iexplore.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2036 wrote to memory of 956 2036 2ee1cfe47fb4e47f6d83cb3cc9a5d54a05d91e7a7f9ccdb06ac16510e1cf3301.exe 28 PID 2036 wrote to memory of 956 2036 2ee1cfe47fb4e47f6d83cb3cc9a5d54a05d91e7a7f9ccdb06ac16510e1cf3301.exe 28 PID 2036 wrote to memory of 956 2036 2ee1cfe47fb4e47f6d83cb3cc9a5d54a05d91e7a7f9ccdb06ac16510e1cf3301.exe 28 PID 2036 wrote to memory of 956 2036 2ee1cfe47fb4e47f6d83cb3cc9a5d54a05d91e7a7f9ccdb06ac16510e1cf3301.exe 28 PID 2036 wrote to memory of 956 2036 2ee1cfe47fb4e47f6d83cb3cc9a5d54a05d91e7a7f9ccdb06ac16510e1cf3301.exe 28 PID 2036 wrote to memory of 956 2036 2ee1cfe47fb4e47f6d83cb3cc9a5d54a05d91e7a7f9ccdb06ac16510e1cf3301.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ee1cfe47fb4e47f6d83cb3cc9a5d54a05d91e7a7f9ccdb06ac16510e1cf3301.exe"C:\Users\Admin\AppData\Local\Temp\2ee1cfe47fb4e47f6d83cb3cc9a5d54a05d91e7a7f9ccdb06ac16510e1cf3301.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:956
-