Analysis
-
max time kernel
108s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
17/12/2022, 08:45
Static task
static1
Behavioral task
behavioral1
Sample
9ff2e7e195b275e3213896128eecbe9d09a2773cf3756724d8e9b43d72caead7.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
9ff2e7e195b275e3213896128eecbe9d09a2773cf3756724d8e9b43d72caead7.exe
Resource
win10v2004-20221111-en
General
-
Target
9ff2e7e195b275e3213896128eecbe9d09a2773cf3756724d8e9b43d72caead7.exe
-
Size
1.9MB
-
MD5
481ee47c38cc1357eaa9750acf1ab376
-
SHA1
3b959ba887e4ad657669c0ce1bd5f5dbe5ef8594
-
SHA256
9ff2e7e195b275e3213896128eecbe9d09a2773cf3756724d8e9b43d72caead7
-
SHA512
ae251a85f8e1be6b6b9e49621b949d45e255c9163e4a34a13d9298260fea032e39e744618eec3f5b5695eb46703b2064e0bb9c0a36f4a63b2606d607755343b4
-
SSDEEP
24576:bMVHBNfNvjt5Mmqc+OHidYIDd3Lj/Stzp+nd+Lw43FVC8q+q8LjzmU3YEIW66W8J:oxBNuYilDd++noLw4TCMjHKAYp8+W1
Malware Config
Signatures
-
Modifies registry class 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" 9ff2e7e195b275e3213896128eecbe9d09a2773cf3756724d8e9b43d72caead7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key 9ff2e7e195b275e3213896128eecbe9d09a2773cf3756724d8e9b43d72caead7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ 9ff2e7e195b275e3213896128eecbe9d09a2773cf3756724d8e9b43d72caead7.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeBackupPrivilege 1496 9ff2e7e195b275e3213896128eecbe9d09a2773cf3756724d8e9b43d72caead7.exe Token: SeRestorePrivilege 1496 9ff2e7e195b275e3213896128eecbe9d09a2773cf3756724d8e9b43d72caead7.exe Token: SeBackupPrivilege 1496 9ff2e7e195b275e3213896128eecbe9d09a2773cf3756724d8e9b43d72caead7.exe Token: SeRestorePrivilege 1496 9ff2e7e195b275e3213896128eecbe9d09a2773cf3756724d8e9b43d72caead7.exe