Analysis
-
max time kernel
142s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
17-08-2023 04:13
Static task
static1
Behavioral task
behavioral1
Sample
8e590ea5a8478079d4b675296669c076fb6fe16788940ec98608f825eb7c21e2.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
8e590ea5a8478079d4b675296669c076fb6fe16788940ec98608f825eb7c21e2.exe
Resource
win10v2004-20230703-en
General
-
Target
8e590ea5a8478079d4b675296669c076fb6fe16788940ec98608f825eb7c21e2.exe
-
Size
1.4MB
-
MD5
951e9bf8db87d4764a1f855ef9cec164
-
SHA1
b12bc40734deb48ea07f609a95d2f9bb71a32b6e
-
SHA256
8e590ea5a8478079d4b675296669c076fb6fe16788940ec98608f825eb7c21e2
-
SHA512
4c49e48622ab2d44fbcfa0515a1801ab15e0c72f3e8d49de7e7dc0c6d63264e89d34ffeccfdbe3e1d9dbb310860196d8f2ed23a2b39a43ce28151ad46dc26030
-
SSDEEP
12288:QgRf6t+I5xDyjGrqSfiicl5kKXLe4t231qje8ZMEsIfgSwe5SqflGx7w74:pG38GQFXpb72lqje8ZYj5RqNGx7O4
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4756 8e590ea5a8478079d4b675296669c076fb6fe16788940ec98608f825eb7c21e2.exe 4756 8e590ea5a8478079d4b675296669c076fb6fe16788940ec98608f825eb7c21e2.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4756 8e590ea5a8478079d4b675296669c076fb6fe16788940ec98608f825eb7c21e2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e590ea5a8478079d4b675296669c076fb6fe16788940ec98608f825eb7c21e2.exe"C:\Users\Admin\AppData\Local\Temp\8e590ea5a8478079d4b675296669c076fb6fe16788940ec98608f825eb7c21e2.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4756