Analysis
-
max time kernel
146s -
max time network
193s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 04:51
Static task
static1
Behavioral task
behavioral1
Sample
982241efe7d64b85ffb4e90be48191cff603cf95c9e188da3c71d42533079e50.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
982241efe7d64b85ffb4e90be48191cff603cf95c9e188da3c71d42533079e50.exe
Resource
win10v2004-20221111-en
General
-
Target
982241efe7d64b85ffb4e90be48191cff603cf95c9e188da3c71d42533079e50.exe
-
Size
760KB
-
MD5
796ea15bda9105bf48493edeb6b82c70
-
SHA1
fc169139cda2c0dd5fa0e26b5bc94e29b72d0f16
-
SHA256
982241efe7d64b85ffb4e90be48191cff603cf95c9e188da3c71d42533079e50
-
SHA512
b68a4c2f6331d47d097efb17432e38ccdbb8f521c9e99692be41b5efbaa5bc64111f6faafa3abf503c3428ebda7a247596bbc00c43300b63a0687db11ef50d3d
-
SSDEEP
12288:K0tnYyXdIwGhJggq8uT+MGMXdAW5nPO9cSI/IkZV:K0tnkwGhCg5uKMX2QW98nZV
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 3028 982241efe7d64b85ffb4e90be48191cff603cf95c9e188da3c71d42533079e50.exe 3028 982241efe7d64b85ffb4e90be48191cff603cf95c9e188da3c71d42533079e50.exe 3028 982241efe7d64b85ffb4e90be48191cff603cf95c9e188da3c71d42533079e50.exe 3028 982241efe7d64b85ffb4e90be48191cff603cf95c9e188da3c71d42533079e50.exe 3028 982241efe7d64b85ffb4e90be48191cff603cf95c9e188da3c71d42533079e50.exe 3028 982241efe7d64b85ffb4e90be48191cff603cf95c9e188da3c71d42533079e50.exe 3028 982241efe7d64b85ffb4e90be48191cff603cf95c9e188da3c71d42533079e50.exe 3028 982241efe7d64b85ffb4e90be48191cff603cf95c9e188da3c71d42533079e50.exe 3028 982241efe7d64b85ffb4e90be48191cff603cf95c9e188da3c71d42533079e50.exe 3028 982241efe7d64b85ffb4e90be48191cff603cf95c9e188da3c71d42533079e50.exe 3028 982241efe7d64b85ffb4e90be48191cff603cf95c9e188da3c71d42533079e50.exe 3028 982241efe7d64b85ffb4e90be48191cff603cf95c9e188da3c71d42533079e50.exe -
Suspicious behavior: LoadsDriver 4 IoCs
pid Process 644 Process not Found 644 Process not Found 644 Process not Found 644 Process not Found -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3028 982241efe7d64b85ffb4e90be48191cff603cf95c9e188da3c71d42533079e50.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3028 982241efe7d64b85ffb4e90be48191cff603cf95c9e188da3c71d42533079e50.exe 3028 982241efe7d64b85ffb4e90be48191cff603cf95c9e188da3c71d42533079e50.exe 3028 982241efe7d64b85ffb4e90be48191cff603cf95c9e188da3c71d42533079e50.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\982241efe7d64b85ffb4e90be48191cff603cf95c9e188da3c71d42533079e50.exe"C:\Users\Admin\AppData\Local\Temp\982241efe7d64b85ffb4e90be48191cff603cf95c9e188da3c71d42533079e50.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3028