Analysis
-
max time kernel
45s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
05-12-2022 08:14
Static task
static1
Behavioral task
behavioral1
Sample
eb2771213a7fef19978ec91671282e47ec826327ffb5c4c3fde30f6725f0ec06.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
eb2771213a7fef19978ec91671282e47ec826327ffb5c4c3fde30f6725f0ec06.exe
Resource
win10v2004-20220812-en
General
-
Target
eb2771213a7fef19978ec91671282e47ec826327ffb5c4c3fde30f6725f0ec06.exe
-
Size
262KB
-
MD5
a73f3be56aa803bbe585787c11a5b612
-
SHA1
00aee3acd8563fd24f94f8a75124408e74a18f4c
-
SHA256
eb2771213a7fef19978ec91671282e47ec826327ffb5c4c3fde30f6725f0ec06
-
SHA512
42d9d7cd637411f85073457eebebd2c0a7d7defca941fbd8ec2fa62173079f892b7923022e601d8e3f5c640ad763c570aa0a49e7c1c11e2b9df9101d73fe8328
-
SSDEEP
3072:PRyEC2Oi8NXC797F8TBfFvj4bq5737OQfragYsMfZ8qYnpAbz7JEp1ydT08EDwGW:PXC2F8NXC796TB9vj483TfMONngJxgg
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2032 eb2771213a7fef19978ec91671282e47ec826327ffb5c4c3fde30f6725f0ec06.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb2771213a7fef19978ec91671282e47ec826327ffb5c4c3fde30f6725f0ec06.exe"C:\Users\Admin\AppData\Local\Temp\eb2771213a7fef19978ec91671282e47ec826327ffb5c4c3fde30f6725f0ec06.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2032
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵PID:1268