e8c208fb8f488971975c0023256c5a955578a1b5299a45d627a4e2d7f8fb850e

Analysis

max time kernel
67s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
03/05/2023, 08:08

Target

WirelessKeyView.exe
Size

256KB
MD5

f577df72c3104df7158c898b64ca53db
SHA1

108266bda26eaa3c1b7aa06ef9dde376dde88bb5
SHA256

e8c208fb8f488971975c0023256c5a955578a1b5299a45d627a4e2d7f8fb850e
SHA512

5a89ea4d6b7fe05e1ea2cc8b51a25e68fb4dbda48a805a77c01e049ebab70412664fce5d611e3f35e64587e269105dc15afdfe0eed4d7719205ac96d1ec52428
SSDEEP

6144:w1w0T70GyPvckzKUOrk/+YW6mhrZOYzYHajVJ:w1w0T71yPTMgGh/hrX3jL

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1308	WirelessKeyView.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1308	WirelessKeyView.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1308	WirelessKeyView.exe
Token: SeDebugPrivilege	1252	WirelessKeyView.exe

C:\Users\Admin\AppData\Local\Temp\WirelessKeyView.exe
"C:\Users\Admin\AppData\Local\Temp\WirelessKeyView.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1308
- C:\Users\Admin\AppData\Local\Temp\WirelessKeyView.exe
  "C:\Users\Admin\AppData\Local\Temp\WirelessKeyView.exe" /GetKeys WirelessKeyView006C056E
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1252