Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
16/08/2023, 04:29
Behavioral task
behavioral1
Sample
5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe
Resource
win7-20230712-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe
-
Size
1.3MB
-
MD5
d1ae0c0096f890f087c34028c6428d28
-
SHA1
29df0ae46d38d89e617b955c6b0111df2f55f244
-
SHA256
5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc
-
SHA512
4cc31f3a1e8488aa29ff49f535821903a8145a923c7ac3eeccdbeeeb3c6158f487108aef80e8457ece78315f54d8de8c894eafbe1d6c9fb85e81726493cef5b6
-
SSDEEP
24576:1Va/eAKKzikAnOHvyKLXktB6/qI5Gn5mvh8xJKE7bG3E:18bKRdOHqKLX4U5wMZC5bOE
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1704-54-0x0000000000400000-0x0000000000A7B000-memory.dmp upx behavioral1/memory/1704-56-0x0000000000400000-0x0000000000A7B000-memory.dmp upx behavioral1/memory/1704-57-0x0000000000400000-0x0000000000A7B000-memory.dmp upx behavioral1/memory/1704-58-0x0000000000400000-0x0000000000A7B000-memory.dmp upx behavioral1/memory/1704-59-0x0000000000400000-0x0000000000A7B000-memory.dmp upx behavioral1/memory/1704-60-0x0000000000400000-0x0000000000A7B000-memory.dmp upx behavioral1/memory/1704-61-0x0000000000400000-0x0000000000A7B000-memory.dmp upx behavioral1/memory/1704-62-0x0000000000400000-0x0000000000A7B000-memory.dmp upx behavioral1/memory/1704-63-0x0000000000400000-0x0000000000A7B000-memory.dmp upx behavioral1/memory/1704-64-0x0000000000400000-0x0000000000A7B000-memory.dmp upx behavioral1/memory/1704-65-0x0000000000400000-0x0000000000A7B000-memory.dmp upx behavioral1/memory/1704-66-0x0000000000400000-0x0000000000A7B000-memory.dmp upx behavioral1/memory/1704-67-0x0000000000400000-0x0000000000A7B000-memory.dmp upx behavioral1/memory/1704-68-0x0000000000400000-0x0000000000A7B000-memory.dmp upx behavioral1/memory/1704-69-0x0000000000400000-0x0000000000A7B000-memory.dmp upx behavioral1/memory/1704-70-0x0000000000400000-0x0000000000A7B000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: 33 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: SeIncBasePriorityPrivilege 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: 33 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: SeIncBasePriorityPrivilege 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: 33 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: SeIncBasePriorityPrivilege 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: 33 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: SeIncBasePriorityPrivilege 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: 33 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: SeIncBasePriorityPrivilege 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: 33 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: SeIncBasePriorityPrivilege 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: 33 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: SeIncBasePriorityPrivilege 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: 33 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: SeIncBasePriorityPrivilege 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: 33 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: SeIncBasePriorityPrivilege 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: 33 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: SeIncBasePriorityPrivilege 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: 33 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: SeIncBasePriorityPrivilege 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: 33 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: SeIncBasePriorityPrivilege 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: 33 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: SeIncBasePriorityPrivilege 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: 33 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: SeIncBasePriorityPrivilege 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: 33 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: SeIncBasePriorityPrivilege 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: 33 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: SeIncBasePriorityPrivilege 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: 33 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: SeIncBasePriorityPrivilege 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: 33 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: SeIncBasePriorityPrivilege 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: 33 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: SeIncBasePriorityPrivilege 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: 33 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: SeIncBasePriorityPrivilege 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: 33 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: SeIncBasePriorityPrivilege 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: 33 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: SeIncBasePriorityPrivilege 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: 33 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: SeIncBasePriorityPrivilege 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: 33 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: SeIncBasePriorityPrivilege 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: 33 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: SeIncBasePriorityPrivilege 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: 33 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: SeIncBasePriorityPrivilege 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: 33 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: SeIncBasePriorityPrivilege 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: 33 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: SeIncBasePriorityPrivilege 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: 33 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: SeIncBasePriorityPrivilege 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: 33 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: SeIncBasePriorityPrivilege 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: 33 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: SeIncBasePriorityPrivilege 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: 33 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe Token: SeIncBasePriorityPrivilege 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe 1704 5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe"C:\Users\Admin\AppData\Local\Temp\5f91e88fa98fe1b78e3078ccf8326dcc0b53ee56d64dded5922a9c58a4f8cabc.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1704