Analysis
-
max time kernel
292s -
max time network
355s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2022 17:17
Behavioral task
behavioral1
Sample
f18185c1617ef70a6298e02ec286b11b.exe
Resource
win7-20221111-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
f18185c1617ef70a6298e02ec286b11b.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
f18185c1617ef70a6298e02ec286b11b.exe
-
Size
675KB
-
MD5
f18185c1617ef70a6298e02ec286b11b
-
SHA1
fde9f897241c40ea80540393370e5c730dd5a660
-
SHA256
5125698974e08a13396bc77aa7113e3d45360f723596ca3ec88838bb08359c82
-
SHA512
7223d406b66b90ea1b105aeb6a0cec08270df00d5be282387aef65eda2d914bf5ca2d3236dfac40d68e5a328e4df9fb2e2ea0ee7b1483d8a932e861a267de33c
-
SSDEEP
12288:HqlMhfymUyZzk8ri+hcGgn9cJBJYGahyHY2oSj97E6zUaCFBhCb0p:H5kxyZFe+hcGEXGwiY2jK5aS
Score
8/10
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/1412-132-0x0000000000400000-0x000000000058E000-memory.dmp upx -
Suspicious use of AdjustPrivilegeToken 34 IoCs
Processes:
f18185c1617ef70a6298e02ec286b11b.exedescription pid process Token: SeCreateTokenPrivilege 1412 f18185c1617ef70a6298e02ec286b11b.exe Token: SeAssignPrimaryTokenPrivilege 1412 f18185c1617ef70a6298e02ec286b11b.exe Token: SeLockMemoryPrivilege 1412 f18185c1617ef70a6298e02ec286b11b.exe Token: SeIncreaseQuotaPrivilege 1412 f18185c1617ef70a6298e02ec286b11b.exe Token: SeMachineAccountPrivilege 1412 f18185c1617ef70a6298e02ec286b11b.exe Token: SeTcbPrivilege 1412 f18185c1617ef70a6298e02ec286b11b.exe Token: SeSecurityPrivilege 1412 f18185c1617ef70a6298e02ec286b11b.exe Token: SeTakeOwnershipPrivilege 1412 f18185c1617ef70a6298e02ec286b11b.exe Token: SeLoadDriverPrivilege 1412 f18185c1617ef70a6298e02ec286b11b.exe Token: SeSystemProfilePrivilege 1412 f18185c1617ef70a6298e02ec286b11b.exe Token: SeSystemtimePrivilege 1412 f18185c1617ef70a6298e02ec286b11b.exe Token: SeProfSingleProcessPrivilege 1412 f18185c1617ef70a6298e02ec286b11b.exe Token: SeIncBasePriorityPrivilege 1412 f18185c1617ef70a6298e02ec286b11b.exe Token: SeCreatePagefilePrivilege 1412 f18185c1617ef70a6298e02ec286b11b.exe Token: SeCreatePermanentPrivilege 1412 f18185c1617ef70a6298e02ec286b11b.exe Token: SeBackupPrivilege 1412 f18185c1617ef70a6298e02ec286b11b.exe Token: SeRestorePrivilege 1412 f18185c1617ef70a6298e02ec286b11b.exe Token: SeShutdownPrivilege 1412 f18185c1617ef70a6298e02ec286b11b.exe Token: SeDebugPrivilege 1412 f18185c1617ef70a6298e02ec286b11b.exe Token: SeAuditPrivilege 1412 f18185c1617ef70a6298e02ec286b11b.exe Token: SeSystemEnvironmentPrivilege 1412 f18185c1617ef70a6298e02ec286b11b.exe Token: SeChangeNotifyPrivilege 1412 f18185c1617ef70a6298e02ec286b11b.exe Token: SeRemoteShutdownPrivilege 1412 f18185c1617ef70a6298e02ec286b11b.exe Token: SeUndockPrivilege 1412 f18185c1617ef70a6298e02ec286b11b.exe Token: SeSyncAgentPrivilege 1412 f18185c1617ef70a6298e02ec286b11b.exe Token: SeEnableDelegationPrivilege 1412 f18185c1617ef70a6298e02ec286b11b.exe Token: SeManageVolumePrivilege 1412 f18185c1617ef70a6298e02ec286b11b.exe Token: SeImpersonatePrivilege 1412 f18185c1617ef70a6298e02ec286b11b.exe Token: SeCreateGlobalPrivilege 1412 f18185c1617ef70a6298e02ec286b11b.exe Token: 31 1412 f18185c1617ef70a6298e02ec286b11b.exe Token: 32 1412 f18185c1617ef70a6298e02ec286b11b.exe Token: 33 1412 f18185c1617ef70a6298e02ec286b11b.exe Token: 34 1412 f18185c1617ef70a6298e02ec286b11b.exe Token: 35 1412 f18185c1617ef70a6298e02ec286b11b.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1412-132-0x0000000000400000-0x000000000058E000-memory.dmpFilesize
1.6MB