Analysis
-
max time kernel
211s -
max time network
259s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
05/12/2022, 19:05
Behavioral task
behavioral1
Sample
fefaff0cd97ffb275bbc4258188a7cb95ac98376e3129477cf08fc76d11783d1.exe
Resource
win7-20221111-en
3 signatures
150 seconds
General
-
Target
fefaff0cd97ffb275bbc4258188a7cb95ac98376e3129477cf08fc76d11783d1.exe
-
Size
647KB
-
MD5
d47f988100c15bd3f2624975c9dcc885
-
SHA1
aec26d5f3cb9024bed0fec70f95c7d74ee553b3f
-
SHA256
fefaff0cd97ffb275bbc4258188a7cb95ac98376e3129477cf08fc76d11783d1
-
SHA512
70911e35f83dc83093a50bb4ca32f800e6f2755f54ca5b259d6f28a6cc4adda64913e847d8565997aba344c6bd9acdc30cca3cb8a867334814892401548914ed
-
SSDEEP
12288:46A84PaHhfD/tV9sj5NKR0pau9XGyu2qBVGLQyTPfha9:9AmBpVKHu0Mu9Xo20VGLVP5a9
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 580 fefaff0cd97ffb275bbc4258188a7cb95ac98376e3129477cf08fc76d11783d1.exe Token: SeSecurityPrivilege 580 fefaff0cd97ffb275bbc4258188a7cb95ac98376e3129477cf08fc76d11783d1.exe Token: SeTakeOwnershipPrivilege 580 fefaff0cd97ffb275bbc4258188a7cb95ac98376e3129477cf08fc76d11783d1.exe Token: SeLoadDriverPrivilege 580 fefaff0cd97ffb275bbc4258188a7cb95ac98376e3129477cf08fc76d11783d1.exe Token: SeSystemProfilePrivilege 580 fefaff0cd97ffb275bbc4258188a7cb95ac98376e3129477cf08fc76d11783d1.exe Token: SeSystemtimePrivilege 580 fefaff0cd97ffb275bbc4258188a7cb95ac98376e3129477cf08fc76d11783d1.exe Token: SeProfSingleProcessPrivilege 580 fefaff0cd97ffb275bbc4258188a7cb95ac98376e3129477cf08fc76d11783d1.exe Token: SeIncBasePriorityPrivilege 580 fefaff0cd97ffb275bbc4258188a7cb95ac98376e3129477cf08fc76d11783d1.exe Token: SeCreatePagefilePrivilege 580 fefaff0cd97ffb275bbc4258188a7cb95ac98376e3129477cf08fc76d11783d1.exe Token: SeBackupPrivilege 580 fefaff0cd97ffb275bbc4258188a7cb95ac98376e3129477cf08fc76d11783d1.exe Token: SeRestorePrivilege 580 fefaff0cd97ffb275bbc4258188a7cb95ac98376e3129477cf08fc76d11783d1.exe Token: SeShutdownPrivilege 580 fefaff0cd97ffb275bbc4258188a7cb95ac98376e3129477cf08fc76d11783d1.exe Token: SeDebugPrivilege 580 fefaff0cd97ffb275bbc4258188a7cb95ac98376e3129477cf08fc76d11783d1.exe Token: SeSystemEnvironmentPrivilege 580 fefaff0cd97ffb275bbc4258188a7cb95ac98376e3129477cf08fc76d11783d1.exe Token: SeChangeNotifyPrivilege 580 fefaff0cd97ffb275bbc4258188a7cb95ac98376e3129477cf08fc76d11783d1.exe Token: SeRemoteShutdownPrivilege 580 fefaff0cd97ffb275bbc4258188a7cb95ac98376e3129477cf08fc76d11783d1.exe Token: SeUndockPrivilege 580 fefaff0cd97ffb275bbc4258188a7cb95ac98376e3129477cf08fc76d11783d1.exe Token: SeManageVolumePrivilege 580 fefaff0cd97ffb275bbc4258188a7cb95ac98376e3129477cf08fc76d11783d1.exe Token: SeImpersonatePrivilege 580 fefaff0cd97ffb275bbc4258188a7cb95ac98376e3129477cf08fc76d11783d1.exe Token: SeCreateGlobalPrivilege 580 fefaff0cd97ffb275bbc4258188a7cb95ac98376e3129477cf08fc76d11783d1.exe Token: 33 580 fefaff0cd97ffb275bbc4258188a7cb95ac98376e3129477cf08fc76d11783d1.exe Token: 34 580 fefaff0cd97ffb275bbc4258188a7cb95ac98376e3129477cf08fc76d11783d1.exe Token: 35 580 fefaff0cd97ffb275bbc4258188a7cb95ac98376e3129477cf08fc76d11783d1.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 580 fefaff0cd97ffb275bbc4258188a7cb95ac98376e3129477cf08fc76d11783d1.exe