Analysis
- max time kernel
91s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
31/01/2023, 06:52
Static task
static1
Behavioral task
behavioral1
Sample
fb49b940570cfd241dea27ae768ac420e863d9f26c5d64f0d10aea4dd0bf0ce3.exe
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
fb49b940570cfd241dea27ae768ac420e863d9f26c5d64f0d10aea4dd0bf0ce3.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target fb49b940570cfd241dea27ae768ac420e863d9f26c5d64f0d10aea4dd0bf0ce3.exe
- Size 245KB
- Sample230131-hm3flagf6y
- SHA256 fb49b940570cfd241dea27ae768ac420e863d9f26c5d64f0d10aea4dd0bf0ce3
- MD5 ea34ac6bf9e8a70bec84e37afeea458a
- SHA1 fd443460ccd1110b0a77385f2f66a38d3f527966
- SHA512 d3bb774467813d0f1e0a8e046dc14a4b372bdd61a6c5448c3b296e09f5f9f7493167b82aa7a6824979154f538ba05178af23247c55e7688fa78414168c13dbfa
- SSDEEP 3072:ZO459Ejzjz10wKaEcKBIacm6QBDOmkm9wXcIfGBF5UgbB67Z:T8HzKxhcKB0VQBLk7XcIkbkt
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1632 fb49b940570cfd241dea27ae768ac420e863d9f26c5d64f0d10aea4dd0bf0ce3.exe 1632 fb49b940570cfd241dea27ae768ac420e863d9f26c5d64f0d10aea4dd0bf0ce3.exe - Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeBackupPrivilege 3492 vssvc.exe Token: SeRestorePrivilege 3492 vssvc.exe Token: SeAuditPrivilege 3492 vssvc.exe Token: SeIncreaseQuotaPrivilege 5008 WMIC.exe Token: SeSecurityPrivilege 5008 WMIC.exe Token: SeTakeOwnershipPrivilege 5008 WMIC.exe Token: SeLoadDriverPrivilege 5008 WMIC.exe Token: SeSystemProfilePrivilege 5008 WMIC.exe Token: SeSystemtimePrivilege 5008 WMIC.exe Token: SeProfSingleProcessPrivilege 5008 WMIC.exe Token: SeIncBasePriorityPrivilege 5008 WMIC.exe Token: SeCreatePagefilePrivilege 5008 WMIC.exe Token: SeBackupPrivilege 5008 WMIC.exe Token: SeRestorePrivilege 5008 WMIC.exe Token: SeShutdownPrivilege 5008 WMIC.exe Token: SeDebugPrivilege 5008 WMIC.exe Token: SeSystemEnvironmentPrivilege 5008 WMIC.exe Token: SeRemoteShutdownPrivilege 5008 WMIC.exe Token: SeUndockPrivilege 5008 WMIC.exe Token: SeManageVolumePrivilege 5008 WMIC.exe Token: 33 5008 WMIC.exe Token: 34 5008 WMIC.exe Token: 35 5008 WMIC.exe Token: 36 5008 WMIC.exe Token: SeIncreaseQuotaPrivilege 5008 WMIC.exe Token: SeSecurityPrivilege 5008 WMIC.exe Token: SeTakeOwnershipPrivilege 5008 WMIC.exe Token: SeLoadDriverPrivilege 5008 WMIC.exe Token: SeSystemProfilePrivilege 5008 WMIC.exe Token: SeSystemtimePrivilege 5008 WMIC.exe Token: SeProfSingleProcessPrivilege 5008 WMIC.exe Token: SeIncBasePriorityPrivilege 5008 WMIC.exe Token: SeCreatePagefilePrivilege 5008 WMIC.exe Token: SeBackupPrivilege 5008 WMIC.exe Token: SeRestorePrivilege 5008 WMIC.exe Token: SeShutdownPrivilege 5008 WMIC.exe Token: SeDebugPrivilege 5008 WMIC.exe Token: SeSystemEnvironmentPrivilege 5008 WMIC.exe Token: SeRemoteShutdownPrivilege 5008 WMIC.exe Token: SeUndockPrivilege 5008 WMIC.exe Token: SeManageVolumePrivilege 5008 WMIC.exe Token: 33 5008 WMIC.exe Token: 34 5008 WMIC.exe Token: 35 5008 WMIC.exe Token: 36 5008 WMIC.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1632 wrote to memory of 5056 1632 fb49b940570cfd241dea27ae768ac420e863d9f26c5d64f0d10aea4dd0bf0ce3.exe 81 PID 1632 wrote to memory of 5056 1632 fb49b940570cfd241dea27ae768ac420e863d9f26c5d64f0d10aea4dd0bf0ce3.exe 81 PID 5056 wrote to memory of 5008 5056 cmd.exe 83 PID 5056 wrote to memory of 5008 5056 cmd.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb49b940570cfd241dea27ae768ac420e863d9f26c5d64f0d10aea4dd0bf0ce3.exe"C:\Users\Admin\AppData\Local\Temp\fb49b940570cfd241dea27ae768ac420e863d9f26c5d64f0d10aea4dd0bf0ce3.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{197EF8A3-6C0C-4392-9954-89785C32C0FB}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{197EF8A3-6C0C-4392-9954-89785C32C0FB}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5008
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3492