Analysis
- max time kernel
90s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
06/02/2023, 04:16
Static task
static1
Behavioral task
behavioral1
Sample
pingbao.scr
Resource
win7-20220812-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
pingbao.scr
Resource
win10v2004-20220812-en
2 signatures
150 seconds
General
- Target pingbao.scr
- Size 18.8MB
- Sample230206-evz4naca69
- SHA256 9624b8343c38e8000f4140dc91527dcfc7700f66e4938544c75cd95faa626d47
- MD5 a07e847b264e8c9345d10bb0a8cfe16b
- SHA1 3fb2b823ffbfde19e54dee5a397c82cf397f7b4b
- SHA512 bcb33edc18f44173c6d4ca8ef8045a149a5f218add8a6a02a294fbcb27b67580e3df165d198fd2fe0cef7468f7ef45b7a15ab6f1f1c3f54f3a38a14ca219503e
- SSDEEP 393216:eMcG6kTk2kZskClpXcrbcv0skhMY5bEdwYFBE837z5zEemeOmcBtjW9ZTMINN/o:C8kLCPcrov0ZmKbEdw+Es79zmtmcTKZI
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeShutdownPrivilege 4832 pingbao.scr Token: SeCreatePagefilePrivilege 4832 pingbao.scr Token: SeShutdownPrivilege 4832 pingbao.scr Token: SeCreatePagefilePrivilege 4832 pingbao.scr Token: SeShutdownPrivilege 4832 pingbao.scr Token: SeCreatePagefilePrivilege 4832 pingbao.scr Token: SeShutdownPrivilege 4832 pingbao.scr Token: SeCreatePagefilePrivilege 4832 pingbao.scr Token: SeShutdownPrivilege 4832 pingbao.scr Token: SeCreatePagefilePrivilege 4832 pingbao.scr Token: SeShutdownPrivilege 4832 pingbao.scr Token: SeCreatePagefilePrivilege 4832 pingbao.scr Token: SeShutdownPrivilege 4832 pingbao.scr Token: SeCreatePagefilePrivilege 4832 pingbao.scr Token: SeShutdownPrivilege 4832 pingbao.scr Token: SeCreatePagefilePrivilege 4832 pingbao.scr Token: SeShutdownPrivilege 4832 pingbao.scr Token: SeCreatePagefilePrivilege 4832 pingbao.scr Token: SeShutdownPrivilege 4832 pingbao.scr Token: SeCreatePagefilePrivilege 4832 pingbao.scr Token: SeShutdownPrivilege 4832 pingbao.scr Token: SeCreatePagefilePrivilege 4832 pingbao.scr Token: SeShutdownPrivilege 4832 pingbao.scr Token: SeCreatePagefilePrivilege 4832 pingbao.scr - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4832 pingbao.scr