Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
24-08-2023 06:12
Behavioral task
behavioral1
Sample
b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe
Resource
win7-20230712-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe
-
Size
10.7MB
-
MD5
55e01ccde663350f90205c74a706ae81
-
SHA1
2f2c95f12d3cb3eaa1bcbf79ea1bfebad0e9051b
-
SHA256
b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025
-
SHA512
d8fc0de1a3b69719e2b4377c159c5d71d1d32b1a13ea65aa5061c8171b3a94d3a79279f8188440c14112568b70cd1d98ba9b6132c272e0c89ba7cbb281db6b46
-
SSDEEP
98304:4R2ST6gbhYU35sX8LAVy4KEIhfdYOPzZTiNT:4R7nhY+5vLAVy4XPOPzaT
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4532 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe Token: SeIncreaseQuotaPrivilege 552 wmic.exe Token: SeSecurityPrivilege 552 wmic.exe Token: SeTakeOwnershipPrivilege 552 wmic.exe Token: SeLoadDriverPrivilege 552 wmic.exe Token: SeSystemProfilePrivilege 552 wmic.exe Token: SeSystemtimePrivilege 552 wmic.exe Token: SeProfSingleProcessPrivilege 552 wmic.exe Token: SeIncBasePriorityPrivilege 552 wmic.exe Token: SeCreatePagefilePrivilege 552 wmic.exe Token: SeBackupPrivilege 552 wmic.exe Token: SeRestorePrivilege 552 wmic.exe Token: SeShutdownPrivilege 552 wmic.exe Token: SeDebugPrivilege 552 wmic.exe Token: SeSystemEnvironmentPrivilege 552 wmic.exe Token: SeRemoteShutdownPrivilege 552 wmic.exe Token: SeUndockPrivilege 552 wmic.exe Token: SeManageVolumePrivilege 552 wmic.exe Token: 33 552 wmic.exe Token: 34 552 wmic.exe Token: 35 552 wmic.exe Token: 36 552 wmic.exe Token: SeIncreaseQuotaPrivilege 552 wmic.exe Token: SeSecurityPrivilege 552 wmic.exe Token: SeTakeOwnershipPrivilege 552 wmic.exe Token: SeLoadDriverPrivilege 552 wmic.exe Token: SeSystemProfilePrivilege 552 wmic.exe Token: SeSystemtimePrivilege 552 wmic.exe Token: SeProfSingleProcessPrivilege 552 wmic.exe Token: SeIncBasePriorityPrivilege 552 wmic.exe Token: SeCreatePagefilePrivilege 552 wmic.exe Token: SeBackupPrivilege 552 wmic.exe Token: SeRestorePrivilege 552 wmic.exe Token: SeShutdownPrivilege 552 wmic.exe Token: SeDebugPrivilege 552 wmic.exe Token: SeSystemEnvironmentPrivilege 552 wmic.exe Token: SeRemoteShutdownPrivilege 552 wmic.exe Token: SeUndockPrivilege 552 wmic.exe Token: SeManageVolumePrivilege 552 wmic.exe Token: 33 552 wmic.exe Token: 34 552 wmic.exe Token: 35 552 wmic.exe Token: 36 552 wmic.exe Token: SeIncreaseQuotaPrivilege 3836 wmic.exe Token: SeSecurityPrivilege 3836 wmic.exe Token: SeTakeOwnershipPrivilege 3836 wmic.exe Token: SeLoadDriverPrivilege 3836 wmic.exe Token: SeSystemProfilePrivilege 3836 wmic.exe Token: SeSystemtimePrivilege 3836 wmic.exe Token: SeProfSingleProcessPrivilege 3836 wmic.exe Token: SeIncBasePriorityPrivilege 3836 wmic.exe Token: SeCreatePagefilePrivilege 3836 wmic.exe Token: SeBackupPrivilege 3836 wmic.exe Token: SeRestorePrivilege 3836 wmic.exe Token: SeShutdownPrivilege 3836 wmic.exe Token: SeDebugPrivilege 3836 wmic.exe Token: SeSystemEnvironmentPrivilege 3836 wmic.exe Token: SeRemoteShutdownPrivilege 3836 wmic.exe Token: SeUndockPrivilege 3836 wmic.exe Token: SeManageVolumePrivilege 3836 wmic.exe Token: 33 3836 wmic.exe Token: 34 3836 wmic.exe Token: 35 3836 wmic.exe Token: 36 3836 wmic.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 4532 wrote to memory of 552 4532 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 83 PID 4532 wrote to memory of 552 4532 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 83 PID 4532 wrote to memory of 3836 4532 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 85 PID 4532 wrote to memory of 3836 4532 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 85 PID 4532 wrote to memory of 5052 4532 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 86 PID 4532 wrote to memory of 5052 4532 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 86 PID 4532 wrote to memory of 4520 4532 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 87 PID 4532 wrote to memory of 4520 4532 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 87 PID 4532 wrote to memory of 2088 4532 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 89 PID 4532 wrote to memory of 2088 4532 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 89 PID 4532 wrote to memory of 3908 4532 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 90 PID 4532 wrote to memory of 3908 4532 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 90 PID 4532 wrote to memory of 4132 4532 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 91 PID 4532 wrote to memory of 4132 4532 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 91 PID 4532 wrote to memory of 1008 4532 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 92 PID 4532 wrote to memory of 1008 4532 b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe"C:\Users\Admin\AppData\Local\Temp\b8ea26cc228123ecb77b46d325f0ec34dd5c9b37e3e4ec492a4bf51840218025.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\System32\Wbem\wmic.exewmic csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:552
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3836
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get uuid2⤵PID:5052
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get uuid2⤵PID:4520
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get uuid2⤵PID:2088
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get uuid2⤵PID:3908
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get uuid2⤵PID:4132
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get uuid2⤵PID:1008
-