Analysis
-
max time kernel
72s -
max time network
75s -
platform
windows7_x64 -
resource
win7-20230703-en -
resource tags
arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system -
submitted
09/07/2023, 19:44
Static task
static1
Behavioral task
behavioral1
Sample
de567e30f47f4fca693009b2b4a506fc0ac7ba6e821822cdde184c99d3823ed8.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
de567e30f47f4fca693009b2b4a506fc0ac7ba6e821822cdde184c99d3823ed8.exe
Resource
win10v2004-20230703-en
General
-
Target
de567e30f47f4fca693009b2b4a506fc0ac7ba6e821822cdde184c99d3823ed8.exe
-
Size
2.2MB
-
MD5
1f4e35432ad902a78804d2d65610555a
-
SHA1
29a2271e223ade1477ddf11a203bcfe37581d528
-
SHA256
de567e30f47f4fca693009b2b4a506fc0ac7ba6e821822cdde184c99d3823ed8
-
SHA512
1c20fe8d4c00b089c23230f154d523dbb677383e921d5227edc306df9183516ea62c2daad8055c38447d35ef0d55d599db05fe4f8793a019e9632b34c643858c
-
SSDEEP
49152:MBCyfwuapFhkX/b4if59o3xp5PMsKIWGXdXYmoy6MNMsM0:HpFhkX/b4if5kz5PMsKIWxTy6MNMsM0
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2344-54-0x00000000003B0000-0x00000000003EE000-memory.dmp upx behavioral1/memory/2344-55-0x00000000003B0000-0x00000000003EE000-memory.dmp upx behavioral1/memory/2344-56-0x00000000003B0000-0x00000000003EE000-memory.dmp upx behavioral1/memory/2344-58-0x00000000003B0000-0x00000000003EE000-memory.dmp upx behavioral1/memory/2344-62-0x00000000003B0000-0x00000000003EE000-memory.dmp upx behavioral1/memory/2344-64-0x00000000003B0000-0x00000000003EE000-memory.dmp upx behavioral1/memory/2344-66-0x00000000003B0000-0x00000000003EE000-memory.dmp upx behavioral1/memory/2344-68-0x00000000003B0000-0x00000000003EE000-memory.dmp upx behavioral1/memory/2344-70-0x00000000003B0000-0x00000000003EE000-memory.dmp upx behavioral1/memory/2344-74-0x00000000003B0000-0x00000000003EE000-memory.dmp upx behavioral1/memory/2344-76-0x00000000003B0000-0x00000000003EE000-memory.dmp upx behavioral1/memory/2344-80-0x00000000003B0000-0x00000000003EE000-memory.dmp upx behavioral1/memory/2344-82-0x00000000003B0000-0x00000000003EE000-memory.dmp upx behavioral1/memory/2344-86-0x00000000003B0000-0x00000000003EE000-memory.dmp upx behavioral1/memory/2344-84-0x00000000003B0000-0x00000000003EE000-memory.dmp upx behavioral1/memory/2344-90-0x00000000003B0000-0x00000000003EE000-memory.dmp upx behavioral1/memory/2344-92-0x00000000003B0000-0x00000000003EE000-memory.dmp upx behavioral1/memory/2344-94-0x00000000003B0000-0x00000000003EE000-memory.dmp upx behavioral1/memory/2344-88-0x00000000003B0000-0x00000000003EE000-memory.dmp upx behavioral1/memory/2344-78-0x00000000003B0000-0x00000000003EE000-memory.dmp upx behavioral1/memory/2344-72-0x00000000003B0000-0x00000000003EE000-memory.dmp upx behavioral1/memory/2344-60-0x00000000003B0000-0x00000000003EE000-memory.dmp upx behavioral1/memory/2344-96-0x00000000003B0000-0x00000000003EE000-memory.dmp upx behavioral1/memory/2344-97-0x00000000003B0000-0x00000000003EE000-memory.dmp upx -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2344 de567e30f47f4fca693009b2b4a506fc0ac7ba6e821822cdde184c99d3823ed8.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2344 de567e30f47f4fca693009b2b4a506fc0ac7ba6e821822cdde184c99d3823ed8.exe 2344 de567e30f47f4fca693009b2b4a506fc0ac7ba6e821822cdde184c99d3823ed8.exe 2344 de567e30f47f4fca693009b2b4a506fc0ac7ba6e821822cdde184c99d3823ed8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\de567e30f47f4fca693009b2b4a506fc0ac7ba6e821822cdde184c99d3823ed8.exe"C:\Users\Admin\AppData\Local\Temp\de567e30f47f4fca693009b2b4a506fc0ac7ba6e821822cdde184c99d3823ed8.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2344