Analysis
-
max time kernel
192s -
max time network
208s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 10:21
Static task
static1
Behavioral task
behavioral1
Sample
23ae263ca4b0aebb1606a82edc3355ec72cce5270ebace9acd693058bac12f57.exe
Resource
win7-20221111-en
windows7-x64
1 signatures
150 seconds
General
-
Target
23ae263ca4b0aebb1606a82edc3355ec72cce5270ebace9acd693058bac12f57.exe
-
Size
708KB
-
MD5
7ccc8794780705ff04b39338b98058b6
-
SHA1
6e35ff8f2ae45879c2db8faf0dba71c8d893b595
-
SHA256
23ae263ca4b0aebb1606a82edc3355ec72cce5270ebace9acd693058bac12f57
-
SHA512
36684e8de7be9f3d515f3cbfd71b1cf8c7ed9d17ade2fafbfbd5687b83bdb9e368a62e70a45aaca411ac1583e1920f951a90efd7fcf1d9ddb253bccdb595ab00
-
SSDEEP
12288:s5lIh4EY1awKtBnrtw8bzRpyMObDkeFsB7pyCEbSTiTwRkfy9h4ORA/KjWHZS:ylFoXBnpw8bzRhObDkvEbSDKC2UmKaHZ
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1380 set thread context of 1848 1380 23ae263ca4b0aebb1606a82edc3355ec72cce5270ebace9acd693058bac12f57.exe 81 -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1848 23ae263ca4b0aebb1606a82edc3355ec72cce5270ebace9acd693058bac12f57.exe Token: SeSecurityPrivilege 1848 23ae263ca4b0aebb1606a82edc3355ec72cce5270ebace9acd693058bac12f57.exe Token: SeTakeOwnershipPrivilege 1848 23ae263ca4b0aebb1606a82edc3355ec72cce5270ebace9acd693058bac12f57.exe Token: SeLoadDriverPrivilege 1848 23ae263ca4b0aebb1606a82edc3355ec72cce5270ebace9acd693058bac12f57.exe Token: SeSystemProfilePrivilege 1848 23ae263ca4b0aebb1606a82edc3355ec72cce5270ebace9acd693058bac12f57.exe Token: SeSystemtimePrivilege 1848 23ae263ca4b0aebb1606a82edc3355ec72cce5270ebace9acd693058bac12f57.exe Token: SeProfSingleProcessPrivilege 1848 23ae263ca4b0aebb1606a82edc3355ec72cce5270ebace9acd693058bac12f57.exe Token: SeIncBasePriorityPrivilege 1848 23ae263ca4b0aebb1606a82edc3355ec72cce5270ebace9acd693058bac12f57.exe Token: SeCreatePagefilePrivilege 1848 23ae263ca4b0aebb1606a82edc3355ec72cce5270ebace9acd693058bac12f57.exe Token: SeBackupPrivilege 1848 23ae263ca4b0aebb1606a82edc3355ec72cce5270ebace9acd693058bac12f57.exe Token: SeRestorePrivilege 1848 23ae263ca4b0aebb1606a82edc3355ec72cce5270ebace9acd693058bac12f57.exe Token: SeShutdownPrivilege 1848 23ae263ca4b0aebb1606a82edc3355ec72cce5270ebace9acd693058bac12f57.exe Token: SeDebugPrivilege 1848 23ae263ca4b0aebb1606a82edc3355ec72cce5270ebace9acd693058bac12f57.exe Token: SeSystemEnvironmentPrivilege 1848 23ae263ca4b0aebb1606a82edc3355ec72cce5270ebace9acd693058bac12f57.exe Token: SeChangeNotifyPrivilege 1848 23ae263ca4b0aebb1606a82edc3355ec72cce5270ebace9acd693058bac12f57.exe Token: SeRemoteShutdownPrivilege 1848 23ae263ca4b0aebb1606a82edc3355ec72cce5270ebace9acd693058bac12f57.exe Token: SeUndockPrivilege 1848 23ae263ca4b0aebb1606a82edc3355ec72cce5270ebace9acd693058bac12f57.exe Token: SeManageVolumePrivilege 1848 23ae263ca4b0aebb1606a82edc3355ec72cce5270ebace9acd693058bac12f57.exe Token: SeImpersonatePrivilege 1848 23ae263ca4b0aebb1606a82edc3355ec72cce5270ebace9acd693058bac12f57.exe Token: SeCreateGlobalPrivilege 1848 23ae263ca4b0aebb1606a82edc3355ec72cce5270ebace9acd693058bac12f57.exe Token: 33 1848 23ae263ca4b0aebb1606a82edc3355ec72cce5270ebace9acd693058bac12f57.exe Token: 34 1848 23ae263ca4b0aebb1606a82edc3355ec72cce5270ebace9acd693058bac12f57.exe Token: 35 1848 23ae263ca4b0aebb1606a82edc3355ec72cce5270ebace9acd693058bac12f57.exe Token: 36 1848 23ae263ca4b0aebb1606a82edc3355ec72cce5270ebace9acd693058bac12f57.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1380 23ae263ca4b0aebb1606a82edc3355ec72cce5270ebace9acd693058bac12f57.exe 1380 23ae263ca4b0aebb1606a82edc3355ec72cce5270ebace9acd693058bac12f57.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1380 wrote to memory of 1848 1380 23ae263ca4b0aebb1606a82edc3355ec72cce5270ebace9acd693058bac12f57.exe 81 PID 1380 wrote to memory of 1848 1380 23ae263ca4b0aebb1606a82edc3355ec72cce5270ebace9acd693058bac12f57.exe 81 PID 1380 wrote to memory of 1848 1380 23ae263ca4b0aebb1606a82edc3355ec72cce5270ebace9acd693058bac12f57.exe 81 PID 1380 wrote to memory of 1848 1380 23ae263ca4b0aebb1606a82edc3355ec72cce5270ebace9acd693058bac12f57.exe 81 PID 1380 wrote to memory of 1848 1380 23ae263ca4b0aebb1606a82edc3355ec72cce5270ebace9acd693058bac12f57.exe 81 PID 1380 wrote to memory of 1848 1380 23ae263ca4b0aebb1606a82edc3355ec72cce5270ebace9acd693058bac12f57.exe 81 PID 1380 wrote to memory of 1848 1380 23ae263ca4b0aebb1606a82edc3355ec72cce5270ebace9acd693058bac12f57.exe 81 PID 1380 wrote to memory of 1848 1380 23ae263ca4b0aebb1606a82edc3355ec72cce5270ebace9acd693058bac12f57.exe 81 PID 1380 wrote to memory of 1848 1380 23ae263ca4b0aebb1606a82edc3355ec72cce5270ebace9acd693058bac12f57.exe 81 PID 1380 wrote to memory of 1848 1380 23ae263ca4b0aebb1606a82edc3355ec72cce5270ebace9acd693058bac12f57.exe 81 PID 1380 wrote to memory of 1848 1380 23ae263ca4b0aebb1606a82edc3355ec72cce5270ebace9acd693058bac12f57.exe 81 PID 1380 wrote to memory of 1848 1380 23ae263ca4b0aebb1606a82edc3355ec72cce5270ebace9acd693058bac12f57.exe 81 PID 1380 wrote to memory of 1848 1380 23ae263ca4b0aebb1606a82edc3355ec72cce5270ebace9acd693058bac12f57.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\23ae263ca4b0aebb1606a82edc3355ec72cce5270ebace9acd693058bac12f57.exe"C:\Users\Admin\AppData\Local\Temp\23ae263ca4b0aebb1606a82edc3355ec72cce5270ebace9acd693058bac12f57.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\23ae263ca4b0aebb1606a82edc3355ec72cce5270ebace9acd693058bac12f57.exeC:\Users\Admin\AppData\Local\Temp\23ae263ca4b0aebb1606a82edc3355ec72cce5270ebace9acd693058bac12f57.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1848
-