Analysis
-
max time kernel
126s -
max time network
252s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
28/03/2023, 04:47
Static task
static1
Behavioral task
behavioral1
Sample
e1a13b501f98bc44503f719cf0905a070b5ce1a42f66d2cb530df8f172274cdc.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
e1a13b501f98bc44503f719cf0905a070b5ce1a42f66d2cb530df8f172274cdc.exe
Resource
win10-20230220-en
General
-
Target
e1a13b501f98bc44503f719cf0905a070b5ce1a42f66d2cb530df8f172274cdc.exe
-
Size
13.5MB
-
MD5
581176025eb809b5120fd584cb9dc237
-
SHA1
27d01c619b0d076e31343eeb456f47f8d27f7574
-
SHA256
e1a13b501f98bc44503f719cf0905a070b5ce1a42f66d2cb530df8f172274cdc
-
SHA512
5b0d4992e2014d76f8c707f96da54d48bc5b17b6aca9e55f8f8eac42e1d6001788ffab043e4b9d0bd4a67f0acb79b0121edc411661b99eb96d9d899a7d25e5d2
-
SSDEEP
393216:bflAEh22VkgTB56Hmuny6SN9XbSgD0t5JheFWofA:LlZHVvUG2HUbSjnKA
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4116 e1a13b501f98bc44503f719cf0905a070b5ce1a42f66d2cb530df8f172274cdc.exe 4116 e1a13b501f98bc44503f719cf0905a070b5ce1a42f66d2cb530df8f172274cdc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4116 e1a13b501f98bc44503f719cf0905a070b5ce1a42f66d2cb530df8f172274cdc.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4116 e1a13b501f98bc44503f719cf0905a070b5ce1a42f66d2cb530df8f172274cdc.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 4116 e1a13b501f98bc44503f719cf0905a070b5ce1a42f66d2cb530df8f172274cdc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1a13b501f98bc44503f719cf0905a070b5ce1a42f66d2cb530df8f172274cdc.exe"C:\Users\Admin\AppData\Local\Temp\e1a13b501f98bc44503f719cf0905a070b5ce1a42f66d2cb530df8f172274cdc.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4116