Analysis
-
max time kernel
23s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
27/11/2022, 15:54
Static task
static1
Behavioral task
behavioral1
Sample
666688bd503b627646162530569a83e7f4197c6351150deaa8b3b821f0b55d97.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
666688bd503b627646162530569a83e7f4197c6351150deaa8b3b821f0b55d97.exe
Resource
win10v2004-20221111-en
General
-
Target
666688bd503b627646162530569a83e7f4197c6351150deaa8b3b821f0b55d97.exe
-
Size
866KB
-
MD5
e5899acb7295c5b289dc94755a5e55ac
-
SHA1
182381c03adca68f6caf6eddd7f6756d4593f059
-
SHA256
666688bd503b627646162530569a83e7f4197c6351150deaa8b3b821f0b55d97
-
SHA512
69a010b55e47d55aa7ace0ded723a0a8849678caad9004aa7f58907ab26d42e841b050b80b6676b7f97a4fc2e9c3ce0a3a3225231ea01cd174bfc58c96ae4734
-
SSDEEP
12288:jdvBuHyIp8ze+uLF/3T1ogpjtzqeF+oEnwdXIYEuOlvR85JDly5JxWmAk9DpiXGa:y71xpFJCwd3EvmJBqxWmAkVpiXG
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1216 666688bd503b627646162530569a83e7f4197c6351150deaa8b3b821f0b55d97.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1216 666688bd503b627646162530569a83e7f4197c6351150deaa8b3b821f0b55d97.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\666688bd503b627646162530569a83e7f4197c6351150deaa8b3b821f0b55d97.exe"C:\Users\Admin\AppData\Local\Temp\666688bd503b627646162530569a83e7f4197c6351150deaa8b3b821f0b55d97.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1216