Analysis
-
max time kernel
150s -
max time network
106s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
09-04-2023 01:13
Behavioral task
behavioral1
Sample
452696c6fe61656effac91973692d516.exe
Resource
win7-20230220-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
452696c6fe61656effac91973692d516.exe
Resource
win10v2004-20230221-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
452696c6fe61656effac91973692d516.exe
-
Size
1.1MB
-
MD5
452696c6fe61656effac91973692d516
-
SHA1
8f44421f8b317cccd5b393680faf813da8c2dedd
-
SHA256
fcb6b3267f23b6f7380932ce6e353723e85eab3b74b01932fcbcdd4668b246de
-
SHA512
06f9eeb405c4ab40ea12baa7d6f03f93eb4a71e0c0faa386268a741acf6da4f423257c1143075f2a74639f67c1c53d1cfdc4235628274f26247c351e110afce3
-
SSDEEP
24576:xVL8VA/noMx1tQqOVrvEk4f4QltIxSZbJ7rDS5fpgFT:g6tx3Qq8LJjQl2xwV7W+d
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 452696c6fe61656effac91973692d516.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e40f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47419000000010000001000000068cb42b035ea773e52ef50ecf50ec52920000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 452696c6fe61656effac91973692d516.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe 1604 452696c6fe61656effac91973692d516.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1604 452696c6fe61656effac91973692d516.exe
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29B
MD5100ad43a6e39d44013fad7f3aa343e3b
SHA1dc8050bdee8a74354cb4a2057e4e703e7a460943
SHA256a7b15ee77dd0db946e7fdbf574889bd30c23fa3d7bff6d509df118595ee14ec5
SHA51220f9b26416804f917d0642d35de32ccae0849c34bff4eb75c6450b1ee83756f3275850101d7482eb59c78356b1489c2d4db6cd95ae9b72b64d5eeab700d36ba8