Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
27-05-2023 16:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe
Resource
win7-20230220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe
-
Size
10.7MB
-
MD5
55e01ccde663350f90205c74a706ae81
-
SHA1
2f2c95f12d3cb3eaa1bcbf79ea1bfebad0e9051b
-
SHA256
b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025
-
SHA512
d8fc0de1a3b69719e2b4377c159c5d71d1d32b1a13ea65aa5061c8171b3a94d3a79279f8188440c14112568b70cd1d98ba9b6132c272e0c89ba7cbb281db6b46
-
SSDEEP
98304:4R2ST6gbhYU35sX8LAVy4KEIhfdYOPzZTiNT:4R7nhY+5vLAVy4XPOPzaT
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3032 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe Token: SeIncreaseQuotaPrivilege 4428 wmic.exe Token: SeSecurityPrivilege 4428 wmic.exe Token: SeTakeOwnershipPrivilege 4428 wmic.exe Token: SeLoadDriverPrivilege 4428 wmic.exe Token: SeSystemProfilePrivilege 4428 wmic.exe Token: SeSystemtimePrivilege 4428 wmic.exe Token: SeProfSingleProcessPrivilege 4428 wmic.exe Token: SeIncBasePriorityPrivilege 4428 wmic.exe Token: SeCreatePagefilePrivilege 4428 wmic.exe Token: SeBackupPrivilege 4428 wmic.exe Token: SeRestorePrivilege 4428 wmic.exe Token: SeShutdownPrivilege 4428 wmic.exe Token: SeDebugPrivilege 4428 wmic.exe Token: SeSystemEnvironmentPrivilege 4428 wmic.exe Token: SeRemoteShutdownPrivilege 4428 wmic.exe Token: SeUndockPrivilege 4428 wmic.exe Token: SeManageVolumePrivilege 4428 wmic.exe Token: 33 4428 wmic.exe Token: 34 4428 wmic.exe Token: 35 4428 wmic.exe Token: 36 4428 wmic.exe Token: SeIncreaseQuotaPrivilege 4428 wmic.exe Token: SeSecurityPrivilege 4428 wmic.exe Token: SeTakeOwnershipPrivilege 4428 wmic.exe Token: SeLoadDriverPrivilege 4428 wmic.exe Token: SeSystemProfilePrivilege 4428 wmic.exe Token: SeSystemtimePrivilege 4428 wmic.exe Token: SeProfSingleProcessPrivilege 4428 wmic.exe Token: SeIncBasePriorityPrivilege 4428 wmic.exe Token: SeCreatePagefilePrivilege 4428 wmic.exe Token: SeBackupPrivilege 4428 wmic.exe Token: SeRestorePrivilege 4428 wmic.exe Token: SeShutdownPrivilege 4428 wmic.exe Token: SeDebugPrivilege 4428 wmic.exe Token: SeSystemEnvironmentPrivilege 4428 wmic.exe Token: SeRemoteShutdownPrivilege 4428 wmic.exe Token: SeUndockPrivilege 4428 wmic.exe Token: SeManageVolumePrivilege 4428 wmic.exe Token: 33 4428 wmic.exe Token: 34 4428 wmic.exe Token: 35 4428 wmic.exe Token: 36 4428 wmic.exe Token: SeIncreaseQuotaPrivilege 1632 wmic.exe Token: SeSecurityPrivilege 1632 wmic.exe Token: SeTakeOwnershipPrivilege 1632 wmic.exe Token: SeLoadDriverPrivilege 1632 wmic.exe Token: SeSystemProfilePrivilege 1632 wmic.exe Token: SeSystemtimePrivilege 1632 wmic.exe Token: SeProfSingleProcessPrivilege 1632 wmic.exe Token: SeIncBasePriorityPrivilege 1632 wmic.exe Token: SeCreatePagefilePrivilege 1632 wmic.exe Token: SeBackupPrivilege 1632 wmic.exe Token: SeRestorePrivilege 1632 wmic.exe Token: SeShutdownPrivilege 1632 wmic.exe Token: SeDebugPrivilege 1632 wmic.exe Token: SeSystemEnvironmentPrivilege 1632 wmic.exe Token: SeRemoteShutdownPrivilege 1632 wmic.exe Token: SeUndockPrivilege 1632 wmic.exe Token: SeManageVolumePrivilege 1632 wmic.exe Token: 33 1632 wmic.exe Token: 34 1632 wmic.exe Token: 35 1632 wmic.exe Token: 36 1632 wmic.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 3032 wrote to memory of 4428 3032 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 85 PID 3032 wrote to memory of 4428 3032 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 85 PID 3032 wrote to memory of 1632 3032 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 86 PID 3032 wrote to memory of 1632 3032 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 86 PID 3032 wrote to memory of 3012 3032 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 87 PID 3032 wrote to memory of 3012 3032 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 87 PID 3032 wrote to memory of 4940 3032 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 88 PID 3032 wrote to memory of 4940 3032 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 88 PID 3032 wrote to memory of 3876 3032 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 89 PID 3032 wrote to memory of 3876 3032 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 89 PID 3032 wrote to memory of 4480 3032 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 90 PID 3032 wrote to memory of 4480 3032 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 90 PID 3032 wrote to memory of 312 3032 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 91 PID 3032 wrote to memory of 312 3032 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 91 PID 3032 wrote to memory of 4328 3032 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 92 PID 3032 wrote to memory of 4328 3032 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe"C:\Users\Admin\AppData\Local\Temp\b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\System32\Wbem\wmic.exewmic csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4428
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1632
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get uuid2⤵PID:3012
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get uuid2⤵PID:4940
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get uuid2⤵PID:3876
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get uuid2⤵PID:4480
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get uuid2⤵PID:312
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get uuid2⤵PID:4328
-