Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
16/08/2023, 04:42
Behavioral task
behavioral1
Sample
475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe
Resource
win7-20230712-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe
-
Size
1.6MB
-
MD5
03affabc131fee68d6026cd8896c1ab2
-
SHA1
e2a2177a663fe19d9fa379c9720cf68ed9567a00
-
SHA256
475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7
-
SHA512
9e849a06c10bb831d5effc43e15cee618cf88af5a0fca8ac6c129fa8b8e78c5959991639c47abbe3e2dc9fe2feef5cf69ab3517c60938088f19c9c58e5e16da9
-
SSDEEP
24576:MsQuCOlZnmlNWiNteybDf4fnrdMbFYW153fqKU2nl8B9uC2j5/wuCGeB1BwlSRZF:MAkWiNtCrs3ir2+uBoX1KB3Cox9Te0
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/636-133-0x0000000000400000-0x0000000000B2C000-memory.dmp upx behavioral2/memory/636-135-0x0000000000400000-0x0000000000B2C000-memory.dmp upx behavioral2/memory/636-136-0x0000000000400000-0x0000000000B2C000-memory.dmp upx behavioral2/memory/636-137-0x0000000000400000-0x0000000000B2C000-memory.dmp upx behavioral2/memory/636-138-0x0000000000400000-0x0000000000B2C000-memory.dmp upx behavioral2/memory/636-139-0x0000000000400000-0x0000000000B2C000-memory.dmp upx behavioral2/memory/636-140-0x0000000000400000-0x0000000000B2C000-memory.dmp upx behavioral2/memory/636-141-0x0000000000400000-0x0000000000B2C000-memory.dmp upx behavioral2/memory/636-142-0x0000000000400000-0x0000000000B2C000-memory.dmp upx behavioral2/memory/636-143-0x0000000000400000-0x0000000000B2C000-memory.dmp upx behavioral2/memory/636-144-0x0000000000400000-0x0000000000B2C000-memory.dmp upx behavioral2/memory/636-145-0x0000000000400000-0x0000000000B2C000-memory.dmp upx behavioral2/memory/636-146-0x0000000000400000-0x0000000000B2C000-memory.dmp upx behavioral2/memory/636-147-0x0000000000400000-0x0000000000B2C000-memory.dmp upx behavioral2/memory/636-148-0x0000000000400000-0x0000000000B2C000-memory.dmp upx behavioral2/memory/636-149-0x0000000000400000-0x0000000000B2C000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: 33 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: SeIncBasePriorityPrivilege 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: 33 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: SeIncBasePriorityPrivilege 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: 33 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: SeIncBasePriorityPrivilege 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: 33 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: SeIncBasePriorityPrivilege 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: 33 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: SeIncBasePriorityPrivilege 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: 33 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: SeIncBasePriorityPrivilege 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: 33 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: SeIncBasePriorityPrivilege 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: 33 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: SeIncBasePriorityPrivilege 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: 33 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: SeIncBasePriorityPrivilege 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: 33 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: SeIncBasePriorityPrivilege 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: 33 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: SeIncBasePriorityPrivilege 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: 33 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: SeIncBasePriorityPrivilege 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: 33 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: SeIncBasePriorityPrivilege 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: 33 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: SeIncBasePriorityPrivilege 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: 33 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: SeIncBasePriorityPrivilege 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: 33 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: SeIncBasePriorityPrivilege 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: 33 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: SeIncBasePriorityPrivilege 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: 33 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: SeIncBasePriorityPrivilege 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: 33 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: SeIncBasePriorityPrivilege 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: 33 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: SeIncBasePriorityPrivilege 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: 33 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: SeIncBasePriorityPrivilege 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: 33 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: SeIncBasePriorityPrivilege 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: 33 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: SeIncBasePriorityPrivilege 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: 33 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: SeIncBasePriorityPrivilege 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: 33 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: SeIncBasePriorityPrivilege 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: 33 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: SeIncBasePriorityPrivilege 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: 33 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: SeIncBasePriorityPrivilege 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: 33 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: SeIncBasePriorityPrivilege 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: 33 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: SeIncBasePriorityPrivilege 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: 33 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: SeIncBasePriorityPrivilege 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: 33 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: SeIncBasePriorityPrivilege 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: 33 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe Token: SeIncBasePriorityPrivilege 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe 636 475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe"C:\Users\Admin\AppData\Local\Temp\475fb5da6ebe3c0d49b3d7db7e70f99f9f51d57259fc8109c673ad084bc6a4e7.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:636