Analysis
- max time kernel
158s - max time network
159s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
26/01/2023, 13:46
Static task
static1
Behavioral task
behavioral1
Sample
a2b1e3eab0206ae9d3eedabd0d2e5cd7.exe
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
a2b1e3eab0206ae9d3eedabd0d2e5cd7.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target a2b1e3eab0206ae9d3eedabd0d2e5cd7.exe
- Size 25KB
- Sample230126-q2zl9afc21
- SHA256 5ace19621489c3b49a59c73552fea0aed3cd4eae367ead58de6dcfe6bbd96fd1
- MD5 a2b1e3eab0206ae9d3eedabd0d2e5cd7
- SHA1 fc7914e0321fa724550067a69dd012a07e698ecc
- SHA512 f7464397262147ea61a9fcf3f29b18199593c5982f0eb5131f777ed934c760138b38b83d4f624658bed08ddafc70a18c446c8e18faed1f6e7578472e3750d19a
- SSDEEP 384:sv3ZIFckP/00C/wuCGy0OE1iriQIQiGcoBlFu9wTeMN6U/XdWN5OpvuK1C74z+Hc:svpV/0TuCK1dLoBlFu9wqBU/XdyZS+8
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4920 a2b1e3eab0206ae9d3eedabd0d2e5cd7.exe - Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeDebugPrivilege 4920 a2b1e3eab0206ae9d3eedabd0d2e5cd7.exe Token: 33 4920 a2b1e3eab0206ae9d3eedabd0d2e5cd7.exe Token: SeIncBasePriorityPrivilege 4920 a2b1e3eab0206ae9d3eedabd0d2e5cd7.exe Token: 33 4920 a2b1e3eab0206ae9d3eedabd0d2e5cd7.exe Token: SeIncBasePriorityPrivilege 4920 a2b1e3eab0206ae9d3eedabd0d2e5cd7.exe Token: 33 4920 a2b1e3eab0206ae9d3eedabd0d2e5cd7.exe Token: SeIncBasePriorityPrivilege 4920 a2b1e3eab0206ae9d3eedabd0d2e5cd7.exe Token: 33 4920 a2b1e3eab0206ae9d3eedabd0d2e5cd7.exe Token: SeIncBasePriorityPrivilege 4920 a2b1e3eab0206ae9d3eedabd0d2e5cd7.exe Token: 33 4920 a2b1e3eab0206ae9d3eedabd0d2e5cd7.exe Token: SeIncBasePriorityPrivilege 4920 a2b1e3eab0206ae9d3eedabd0d2e5cd7.exe Token: 33 4920 a2b1e3eab0206ae9d3eedabd0d2e5cd7.exe Token: SeIncBasePriorityPrivilege 4920 a2b1e3eab0206ae9d3eedabd0d2e5cd7.exe Token: 33 4920 a2b1e3eab0206ae9d3eedabd0d2e5cd7.exe Token: SeIncBasePriorityPrivilege 4920 a2b1e3eab0206ae9d3eedabd0d2e5cd7.exe Token: 33 4920 a2b1e3eab0206ae9d3eedabd0d2e5cd7.exe Token: SeIncBasePriorityPrivilege 4920 a2b1e3eab0206ae9d3eedabd0d2e5cd7.exe Token: 33 4920 a2b1e3eab0206ae9d3eedabd0d2e5cd7.exe Token: SeIncBasePriorityPrivilege 4920 a2b1e3eab0206ae9d3eedabd0d2e5cd7.exe Token: 33 4920 a2b1e3eab0206ae9d3eedabd0d2e5cd7.exe Token: SeIncBasePriorityPrivilege 4920 a2b1e3eab0206ae9d3eedabd0d2e5cd7.exe Token: 33 4920 a2b1e3eab0206ae9d3eedabd0d2e5cd7.exe Token: SeIncBasePriorityPrivilege 4920 a2b1e3eab0206ae9d3eedabd0d2e5cd7.exe Token: 33 4920 a2b1e3eab0206ae9d3eedabd0d2e5cd7.exe Token: SeIncBasePriorityPrivilege 4920 a2b1e3eab0206ae9d3eedabd0d2e5cd7.exe Token: 33 4920 a2b1e3eab0206ae9d3eedabd0d2e5cd7.exe Token: SeIncBasePriorityPrivilege 4920 a2b1e3eab0206ae9d3eedabd0d2e5cd7.exe Token: 33 4920 a2b1e3eab0206ae9d3eedabd0d2e5cd7.exe Token: SeIncBasePriorityPrivilege 4920 a2b1e3eab0206ae9d3eedabd0d2e5cd7.exe Token: 33 4920 a2b1e3eab0206ae9d3eedabd0d2e5cd7.exe Token: SeIncBasePriorityPrivilege 4920 a2b1e3eab0206ae9d3eedabd0d2e5cd7.exe Token: 33 4920 a2b1e3eab0206ae9d3eedabd0d2e5cd7.exe Token: SeIncBasePriorityPrivilege 4920 a2b1e3eab0206ae9d3eedabd0d2e5cd7.exe Token: 33 4920 a2b1e3eab0206ae9d3eedabd0d2e5cd7.exe Token: SeIncBasePriorityPrivilege 4920 a2b1e3eab0206ae9d3eedabd0d2e5cd7.exe Token: 33 4920 a2b1e3eab0206ae9d3eedabd0d2e5cd7.exe Token: SeIncBasePriorityPrivilege 4920 a2b1e3eab0206ae9d3eedabd0d2e5cd7.exe