Analysis
-
max time kernel
145s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
24/08/2023, 01:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
840006dac67d23b7725020c8441a6a4b.exe
Resource
win7-20230712-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
840006dac67d23b7725020c8441a6a4b.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
840006dac67d23b7725020c8441a6a4b.exe
-
Size
431KB
-
MD5
840006dac67d23b7725020c8441a6a4b
-
SHA1
27da8a80d2cd2a2740dbaba69b4440f5ef4baaa4
-
SHA256
31fd5ab4ff38fd42399d4d90a19da71b94cd7ba47b0a97ce1bda37958ce97ef6
-
SHA512
369eb8c565ae374b093e7bc4ef578c8f48a77e37b994b0b3b8023a842e5c435894e2bf4894e7ee3aa770ab96268f3d023e1694777104f43794d9327c2234eefa
-
SSDEEP
6144:xougwOscwOzGNKDazRtZoZdLJufjI3RYOllVn9k/6E9MzKi:oacjzkRfG9OI3799k/6E9M+
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4944 set thread context of 4804 4944 840006dac67d23b7725020c8441a6a4b.exe 82 -
Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe 4804 Caspol.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4944 840006dac67d23b7725020c8441a6a4b.exe Token: SeDebugPrivilege 4804 Caspol.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4944 wrote to memory of 4804 4944 840006dac67d23b7725020c8441a6a4b.exe 82 PID 4944 wrote to memory of 4804 4944 840006dac67d23b7725020c8441a6a4b.exe 82 PID 4944 wrote to memory of 4804 4944 840006dac67d23b7725020c8441a6a4b.exe 82 PID 4944 wrote to memory of 4804 4944 840006dac67d23b7725020c8441a6a4b.exe 82 PID 4944 wrote to memory of 4804 4944 840006dac67d23b7725020c8441a6a4b.exe 82 PID 4944 wrote to memory of 4804 4944 840006dac67d23b7725020c8441a6a4b.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\840006dac67d23b7725020c8441a6a4b.exe"C:\Users\Admin\AppData\Local\Temp\840006dac67d23b7725020c8441a6a4b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4804
-