Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
19/08/2023, 20:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe
Resource
win7-20230712-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe
-
Size
2.2MB
-
MD5
a5b20d2787f4e34ab8f7f10682bfeb7b
-
SHA1
ddab7d9be97cc3b3233895f261529c4b90c20a52
-
SHA256
640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c
-
SHA512
20851badb6039822faf008c8ea555adbd7b29399145fa37c5154630c22d23e5775d983164002150e1db9c76c3e7f7a072bee20d2b9379556f15232cd2981d78a
-
SSDEEP
49152:4ysjt0ExBDaT2/sxFzqVPTr9AWIhDDke5lcUj4JgfWRtR0+W:7ut0ExBuT2MgVFyWUjP8RE
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe -
Modifies registry class 2 IoCs
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_CLASSES\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\SHELL\MUICACHE 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe Key deleted \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe 1216 640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe"C:\Users\Admin\AppData\Local\Temp\640821a8b500cd14d79f7ab2c7ab62a9bc2c24c1028fa8a482b588ea9234a81c.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1216