Analysis
-
max time kernel
36s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01/12/2022, 22:57
Behavioral task
behavioral1
Sample
70e21fbde33523408a5872aa8cb6eeef3e0b810dd8243bb13285f1477b56974b.exe
Resource
win7-20220812-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
70e21fbde33523408a5872aa8cb6eeef3e0b810dd8243bb13285f1477b56974b.exe
Resource
win10v2004-20221111-en
3 signatures
150 seconds
General
-
Target
70e21fbde33523408a5872aa8cb6eeef3e0b810dd8243bb13285f1477b56974b.exe
-
Size
1.7MB
-
MD5
07b0060556bbab391fa9d530af55aaea
-
SHA1
c1feec98679ef73e49c0595efbdbd1e1a67f980a
-
SHA256
70e21fbde33523408a5872aa8cb6eeef3e0b810dd8243bb13285f1477b56974b
-
SHA512
f2eacf830d88b2d643e5eb0096ba237b8c5a81b1db60940698250c06b67ed205f1cca4b70aade7fdec04b532b29a7775d2452db97b8cfc19be4bf61e19e40474
-
SSDEEP
49152:LoHxGeoPseo7ZBj6MVn/X5+O6SM3BeaVrv:LoHx/oEeoxVPMO6txv
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1352-54-0x0000000000400000-0x0000000000830000-memory.dmp vmprotect behavioral1/memory/1352-55-0x0000000000400000-0x0000000000830000-memory.dmp vmprotect behavioral1/memory/1352-56-0x0000000000400000-0x0000000000830000-memory.dmp vmprotect behavioral1/memory/1352-61-0x0000000000400000-0x0000000000830000-memory.dmp vmprotect -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main 70e21fbde33523408a5872aa8cb6eeef3e0b810dd8243bb13285f1477b56974b.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeShutdownPrivilege 1352 70e21fbde33523408a5872aa8cb6eeef3e0b810dd8243bb13285f1477b56974b.exe Token: SeShutdownPrivilege 1352 70e21fbde33523408a5872aa8cb6eeef3e0b810dd8243bb13285f1477b56974b.exe Token: SeShutdownPrivilege 1352 70e21fbde33523408a5872aa8cb6eeef3e0b810dd8243bb13285f1477b56974b.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1352 70e21fbde33523408a5872aa8cb6eeef3e0b810dd8243bb13285f1477b56974b.exe 1352 70e21fbde33523408a5872aa8cb6eeef3e0b810dd8243bb13285f1477b56974b.exe 1352 70e21fbde33523408a5872aa8cb6eeef3e0b810dd8243bb13285f1477b56974b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\70e21fbde33523408a5872aa8cb6eeef3e0b810dd8243bb13285f1477b56974b.exe"C:\Users\Admin\AppData\Local\Temp\70e21fbde33523408a5872aa8cb6eeef3e0b810dd8243bb13285f1477b56974b.exe"1⤵
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1352