Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10-1703_x64 -
resource
win10-20230915-en -
resource tags
arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system -
submitted
24-05-2023 15:03
Behavioral task
behavioral1
Sample
d74d2d384f1299ad1d4c95ff862bee34aca4bfe03f416dfefc64c2106e18f1e0.exe
Resource
win10-20230915-en
windows10-1703-x64
3 signatures
150 seconds
General
-
Target
d74d2d384f1299ad1d4c95ff862bee34aca4bfe03f416dfefc64c2106e18f1e0.exe
-
Size
3.8MB
-
MD5
e376ec4ae5c103889066b13c6f16a60f
-
SHA1
10485b870011cc685750cc8694ed9f8e602d966e
-
SHA256
d74d2d384f1299ad1d4c95ff862bee34aca4bfe03f416dfefc64c2106e18f1e0
-
SHA512
b53ff2123001c55a939de7462fb309069e097f6a06148c4d4c5a1711b293e1dcd490fad793aac1ba38e2e392c9cf9c876121368a8033c9a9fb9bbc497db30799
-
SSDEEP
98304:877Pmq33rE/JDLPWZADUGer7B6iY74M/HmlwXVZaFB:K+R/eZADUXR
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
pid Process 5096 d74d2d384f1299ad1d4c95ff862bee34aca4bfe03f416dfefc64c2106e18f1e0.exe 5096 d74d2d384f1299ad1d4c95ff862bee34aca4bfe03f416dfefc64c2106e18f1e0.exe 5096 d74d2d384f1299ad1d4c95ff862bee34aca4bfe03f416dfefc64c2106e18f1e0.exe 5096 d74d2d384f1299ad1d4c95ff862bee34aca4bfe03f416dfefc64c2106e18f1e0.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 5096 d74d2d384f1299ad1d4c95ff862bee34aca4bfe03f416dfefc64c2106e18f1e0.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5096 d74d2d384f1299ad1d4c95ff862bee34aca4bfe03f416dfefc64c2106e18f1e0.exe 5096 d74d2d384f1299ad1d4c95ff862bee34aca4bfe03f416dfefc64c2106e18f1e0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d74d2d384f1299ad1d4c95ff862bee34aca4bfe03f416dfefc64c2106e18f1e0.exe"C:\Users\Admin\AppData\Local\Temp\d74d2d384f1299ad1d4c95ff862bee34aca4bfe03f416dfefc64c2106e18f1e0.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5096