Analysis
-
max time kernel
48s -
max time network
36s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
22/08/2023, 15:32
Static task
static1
Behavioral task
behavioral1
Sample
fc2808e2a3ae5ba3c66317f9701b1992d6c7bbe2ef4eaf715b797e81459a44fe.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
fc2808e2a3ae5ba3c66317f9701b1992d6c7bbe2ef4eaf715b797e81459a44fe.exe
Resource
win10v2004-20230703-en
General
-
Target
fc2808e2a3ae5ba3c66317f9701b1992d6c7bbe2ef4eaf715b797e81459a44fe.exe
-
Size
850KB
-
MD5
655c20604e9d077b1bd99343627fd188
-
SHA1
3d883b6355e36caca1a89cb1de98fd96b195ec1a
-
SHA256
fc2808e2a3ae5ba3c66317f9701b1992d6c7bbe2ef4eaf715b797e81459a44fe
-
SHA512
1408bb9bc5b9ba50961c4fff481e3b4b13234be2bd7459936dab1bef2e75fb10915bd6fd88904bbd9a8d1d5ba97f31d1effd4d098b4791d2242e79b0164ea45c
-
SSDEEP
12288:MUVv25w+zB5tY2d1mbTuJEFjpI4cMHGOayaFVd4WzTcumVuhp+KGKBEIQVwefnYF:MdzBH8uJEppdatZzI8p+3XvY0JhTU
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 3232 fc2808e2a3ae5ba3c66317f9701b1992d6c7bbe2ef4eaf715b797e81459a44fe.exe 3232 fc2808e2a3ae5ba3c66317f9701b1992d6c7bbe2ef4eaf715b797e81459a44fe.exe 3232 fc2808e2a3ae5ba3c66317f9701b1992d6c7bbe2ef4eaf715b797e81459a44fe.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3232 fc2808e2a3ae5ba3c66317f9701b1992d6c7bbe2ef4eaf715b797e81459a44fe.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc2808e2a3ae5ba3c66317f9701b1992d6c7bbe2ef4eaf715b797e81459a44fe.exe"C:\Users\Admin\AppData\Local\Temp\fc2808e2a3ae5ba3c66317f9701b1992d6c7bbe2ef4eaf715b797e81459a44fe.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3232