Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
23/08/2023, 21:43
Behavioral task
behavioral1
Sample
e45c60f0db94841abb21d866f5def9b4e205c633a851e9b7527dcf550e0aad31.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
e45c60f0db94841abb21d866f5def9b4e205c633a851e9b7527dcf550e0aad31.exe
Resource
win10v2004-20230703-en
3 signatures
150 seconds
General
-
Target
e45c60f0db94841abb21d866f5def9b4e205c633a851e9b7527dcf550e0aad31.exe
-
Size
509KB
-
MD5
8bc779f60a7394b4d7afa3148dae9d30
-
SHA1
a933fd48a6639e08895d955303e31490eab7c1cd
-
SHA256
e45c60f0db94841abb21d866f5def9b4e205c633a851e9b7527dcf550e0aad31
-
SHA512
269b36dedfb1088175b9d300b715ce99c960c3db63dc6cdd36dfe6109e9ba3e112d44cddde97de62471258107b24d032a67bc25078805f8fa734d8139c6f179e
-
SSDEEP
12288:VVPK5ImvolQtk1DMbqjmYiERDMfhQpz7z7lugzV7hGBNhoSdc:Vnmvrk1xjmYiRZQpzP7T
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1224-0-0x0000000000400000-0x0000000000549000-memory.dmp upx behavioral2/memory/1224-4-0x0000000000400000-0x0000000000549000-memory.dmp upx behavioral2/memory/1224-5-0x0000000000400000-0x0000000000549000-memory.dmp upx behavioral2/memory/1224-12-0x0000000000400000-0x0000000000549000-memory.dmp upx behavioral2/memory/1224-13-0x0000000000400000-0x0000000000549000-memory.dmp upx behavioral2/memory/1224-14-0x0000000000400000-0x0000000000549000-memory.dmp upx behavioral2/memory/1224-15-0x0000000000400000-0x0000000000549000-memory.dmp upx -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1224 e45c60f0db94841abb21d866f5def9b4e205c633a851e9b7527dcf550e0aad31.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1224 e45c60f0db94841abb21d866f5def9b4e205c633a851e9b7527dcf550e0aad31.exe 1224 e45c60f0db94841abb21d866f5def9b4e205c633a851e9b7527dcf550e0aad31.exe 1224 e45c60f0db94841abb21d866f5def9b4e205c633a851e9b7527dcf550e0aad31.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e45c60f0db94841abb21d866f5def9b4e205c633a851e9b7527dcf550e0aad31.exe"C:\Users\Admin\AppData\Local\Temp\e45c60f0db94841abb21d866f5def9b4e205c633a851e9b7527dcf550e0aad31.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1224