Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
15/01/2023, 03:57
Static task
static1
Behavioral task
behavioral1
Sample
c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe
-
Size
256KB
-
MD5
29c2749abae125cb557c34a525926d6e
-
SHA1
7bf5114008cbff57e1c0da655d868e0fa6b6361a
-
SHA256
c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f
-
SHA512
4884d2c05b46061ebca05387337d4a05b2276ea4895dd5215d18e4809ee7953add35fa5fdfd86f51713e3eb790e1baffe8c2c2934a0fb06e1a6a7073bf052de4
-
SSDEEP
3072:+dq9jmxIuj81MaOZOAkWeUN7EonFcYXdFiE7z0U4ayYSg1HCdnyxolRTZan6mLS:FCxLaOZuWxdEGFcY5ri86
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\conf.ntp c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeSystemtimePrivilege 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe Token: SeSystemtimePrivilege 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe Token: SeSystemtimePrivilege 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe Token: SeSystemtimePrivilege 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe Token: SeSystemtimePrivilege 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe Token: SeSystemtimePrivilege 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe Token: SeSystemtimePrivilege 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe Token: SeSystemtimePrivilege 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe Token: SeSystemtimePrivilege 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe Token: SeSystemtimePrivilege 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe 4488 c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe"C:\Users\Admin\AppData\Local\Temp\c3c6f1bc95a5aaa15b6101b3486b47d2dea658d72b61c920a15aff8f7928867f.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4488