Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05-12-2022 10:34
Static task
static1
Behavioral task
behavioral1
Sample
a14756a9ccdadfea513c010ee95578414f62481a0e7eaad5cd6b38de288ea2dd.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a14756a9ccdadfea513c010ee95578414f62481a0e7eaad5cd6b38de288ea2dd.exe
Resource
win10v2004-20220812-en
General
-
Target
a14756a9ccdadfea513c010ee95578414f62481a0e7eaad5cd6b38de288ea2dd.exe
-
Size
212KB
-
MD5
69a20096d078e18496d2ae8054a64f1f
-
SHA1
2f988da1ad7f7ff76227ce970f7e3c9f97ed068b
-
SHA256
a14756a9ccdadfea513c010ee95578414f62481a0e7eaad5cd6b38de288ea2dd
-
SHA512
2c9997a0fc2eb9cdb70b9adf66dff9145ff601f65f11b1e863adce8f68f0f0b07acadf4c4968c0329a95aeeafe56db8ae0b8a8a396ba91495446ddee97f49ad1
-
SSDEEP
3072:oqVWp0VZdY+SUUGTTaLLOoFmm5CBHKapZBVrx+pGdJebf+bBJnXJ:oqV8slRILnFmmEBHDpZBFcRKBJZ
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4988 a14756a9ccdadfea513c010ee95578414f62481a0e7eaad5cd6b38de288ea2dd.exe 4988 a14756a9ccdadfea513c010ee95578414f62481a0e7eaad5cd6b38de288ea2dd.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4988 a14756a9ccdadfea513c010ee95578414f62481a0e7eaad5cd6b38de288ea2dd.exe Token: SeDebugPrivilege 4988 a14756a9ccdadfea513c010ee95578414f62481a0e7eaad5cd6b38de288ea2dd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a14756a9ccdadfea513c010ee95578414f62481a0e7eaad5cd6b38de288ea2dd.exe"C:\Users\Admin\AppData\Local\Temp\a14756a9ccdadfea513c010ee95578414f62481a0e7eaad5cd6b38de288ea2dd.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4988