Analysis
- max time kernel
151s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system - submitted
01/04/2023, 17:08
Static task
static1
Behavioral task
behavioral1
Sample
bLgB.exe
Resource
win7-20230220-en
windows7-x64
1 signatures
150 seconds
General
- Target bLgB.exe
- Size 26KB
- Sample230401-vnkcmabd24
- SHA256 e3f457f1d65d5b08f5509536bb3f0d33fd84fa1d7fbe7971891933b3f20ca3dc
- MD5 43f9b25d261235a2dc51d0e2801c0dfc
- SHA1 7a4e912d84f7064563b2e46a9bf1fcf6ae83e8b7
- SHA512 f269e6524b7622d714216a13163c3a030df7c32605c8525038d69986cc62020135424b845978ae63635bf7b7d5b75770d42b90b93aa0ec06cd694eb294470cce
- SSDEEP 384:jLd6G6qSDWo/BqeNzHzCYe/4Y2OzRLTm3yilqr63Rb0tVvGD:n/8DW6hzT5e/4sEuVvGD
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4192 bLgB.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4192 bLgB.exe Token: 33 4192 bLgB.exe Token: SeIncBasePriorityPrivilege 4192 bLgB.exe Token: 33 4192 bLgB.exe Token: SeIncBasePriorityPrivilege 4192 bLgB.exe Token: 33 4192 bLgB.exe Token: SeIncBasePriorityPrivilege 4192 bLgB.exe Token: 33 4192 bLgB.exe Token: SeIncBasePriorityPrivilege 4192 bLgB.exe Token: 33 4192 bLgB.exe Token: SeIncBasePriorityPrivilege 4192 bLgB.exe Token: 33 4192 bLgB.exe Token: SeIncBasePriorityPrivilege 4192 bLgB.exe Token: 33 4192 bLgB.exe Token: SeIncBasePriorityPrivilege 4192 bLgB.exe Token: 33 4192 bLgB.exe Token: SeIncBasePriorityPrivilege 4192 bLgB.exe Token: 33 4192 bLgB.exe Token: SeIncBasePriorityPrivilege 4192 bLgB.exe Token: 33 4192 bLgB.exe Token: SeIncBasePriorityPrivilege 4192 bLgB.exe Token: 33 4192 bLgB.exe Token: SeIncBasePriorityPrivilege 4192 bLgB.exe Token: 33 4192 bLgB.exe Token: SeIncBasePriorityPrivilege 4192 bLgB.exe Token: 33 4192 bLgB.exe Token: SeIncBasePriorityPrivilege 4192 bLgB.exe Token: 33 4192 bLgB.exe Token: SeIncBasePriorityPrivilege 4192 bLgB.exe Token: 33 4192 bLgB.exe Token: SeIncBasePriorityPrivilege 4192 bLgB.exe Token: 33 4192 bLgB.exe Token: SeIncBasePriorityPrivilege 4192 bLgB.exe Token: 33 4192 bLgB.exe Token: SeIncBasePriorityPrivilege 4192 bLgB.exe Token: 33 4192 bLgB.exe Token: SeIncBasePriorityPrivilege 4192 bLgB.exe Token: 33 4192 bLgB.exe Token: SeIncBasePriorityPrivilege 4192 bLgB.exe Token: 33 4192 bLgB.exe Token: SeIncBasePriorityPrivilege 4192 bLgB.exe Token: 33 4192 bLgB.exe Token: SeIncBasePriorityPrivilege 4192 bLgB.exe Token: 33 4192 bLgB.exe Token: SeIncBasePriorityPrivilege 4192 bLgB.exe Token: 33 4192 bLgB.exe Token: SeIncBasePriorityPrivilege 4192 bLgB.exe Token: 33 4192 bLgB.exe Token: SeIncBasePriorityPrivilege 4192 bLgB.exe Token: 33 4192 bLgB.exe Token: SeIncBasePriorityPrivilege 4192 bLgB.exe Token: 33 4192 bLgB.exe Token: SeIncBasePriorityPrivilege 4192 bLgB.exe Token: 33 4192 bLgB.exe Token: SeIncBasePriorityPrivilege 4192 bLgB.exe Token: 33 4192 bLgB.exe Token: SeIncBasePriorityPrivilege 4192 bLgB.exe Token: 33 4192 bLgB.exe Token: SeIncBasePriorityPrivilege 4192 bLgB.exe Token: 33 4192 bLgB.exe Token: SeIncBasePriorityPrivilege 4192 bLgB.exe Token: 33 4192 bLgB.exe Token: SeIncBasePriorityPrivilege 4192 bLgB.exe Token: 33 4192 bLgB.exe