Analysis
-
max time kernel
226s -
max time network
335s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
02/12/2022, 01:11
Static task
static1
Behavioral task
behavioral1
Sample
b16b8a3ebd3590adcb24a40b16b6d1c84fa94383ea3535f77bf29cd2e9eec2dd.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
b16b8a3ebd3590adcb24a40b16b6d1c84fa94383ea3535f77bf29cd2e9eec2dd.exe
Resource
win10v2004-20220812-en
General
-
Target
b16b8a3ebd3590adcb24a40b16b6d1c84fa94383ea3535f77bf29cd2e9eec2dd.exe
-
Size
68KB
-
MD5
30eed5d06592efa2d74cda1f5830c1bf
-
SHA1
c472e58ad6f9012bb1e1a60e2ce48b94cc0f6b30
-
SHA256
b16b8a3ebd3590adcb24a40b16b6d1c84fa94383ea3535f77bf29cd2e9eec2dd
-
SHA512
2dad0d369031d33dd3696fbc498ef0adc64ef85cef51c8fa4e7e35a052c84ba92895c401c311cdc04cc31c17dc87f31f2af3bad1ee9f905fc4065f4f94ec1faf
-
SSDEEP
768:mzfZA6xhqGi3b3Oimr7zCCX7Z+Xp9w0Qxr07oxtDH247KnUYMFO82X1D0UFR:ufZy7K7/X7ZQwrr0ExNHU7MFqXbR
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1172 b16b8a3ebd3590adcb24a40b16b6d1c84fa94383ea3535f77bf29cd2e9eec2dd.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1172 b16b8a3ebd3590adcb24a40b16b6d1c84fa94383ea3535f77bf29cd2e9eec2dd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b16b8a3ebd3590adcb24a40b16b6d1c84fa94383ea3535f77bf29cd2e9eec2dd.exe"C:\Users\Admin\AppData\Local\Temp\b16b8a3ebd3590adcb24a40b16b6d1c84fa94383ea3535f77bf29cd2e9eec2dd.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1172