Analysis
-
max time kernel
31s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
30-03-2023 14:18
General
-
Target
e277097c4ad7ce51c64e41f80e87e8d6bae51e5a89ef78ffefc438a8e80546cd.exe
-
Size
4.3MB
-
MD5
822d385ffc321a4e9042ecc11c7b46df
-
SHA1
5cb4f113ad2c4fab27d9ad101b5a3734d1764aeb
-
SHA256
e277097c4ad7ce51c64e41f80e87e8d6bae51e5a89ef78ffefc438a8e80546cd
-
SHA512
a9b69f211a2faa495ef8b13acd624194c44172663ef07ff01ad3d58505de312f9b06fa106a2e0c4e61bd821b529fda07894a7ee9efb952da0cdbd843fe0a1396
-
SSDEEP
49152:H1gF8jnXMJQbkaMB79ls430YCAV0BGiuvLoxbKKMpHpkx9dUIPcTm:V4Z9ZpBQY9IP9
Score
6/10
Malware Config
Signatures
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e277097c4ad7ce51c64e41f80e87e8d6bae51e5a89ef78ffefc438a8e80546cd.exe"C:\Users\Admin\AppData\Local\Temp\e277097c4ad7ce51c64e41f80e87e8d6bae51e5a89ef78ffefc438a8e80546cd.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken