Analysis
-
max time kernel
91s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2023, 23:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a4556c5417ccafc24becd8a1716d242b0a8964d5562ff36a505ea9c3b068ffd3.dll
Resource
win7-20230712-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
a4556c5417ccafc24becd8a1716d242b0a8964d5562ff36a505ea9c3b068ffd3.dll
Resource
win10v2004-20230703-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
a4556c5417ccafc24becd8a1716d242b0a8964d5562ff36a505ea9c3b068ffd3.dll
-
Size
2.6MB
-
MD5
ad9701822763db16e60d338eb17659c3
-
SHA1
5f1d6f42e1fc7732d69815778cc8c8c0a0efd688
-
SHA256
a4556c5417ccafc24becd8a1716d242b0a8964d5562ff36a505ea9c3b068ffd3
-
SHA512
a7117c595f6904f13e3df5e767194a55541721cabb3f66ee609da73d218a466dc1ffacb4e264f0a9ec65e16ec23e09a228581b2b3d8e6a82fae9db8c2a52917c
-
SSDEEP
49152:bXWqHjdAlG40TVApPHWy6Tp+s8KuqGaX0ToIBAUZLY73nb:z7HjdAlG440lJJBAUZLE
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2632 WMIC.exe Token: SeSecurityPrivilege 2632 WMIC.exe Token: SeTakeOwnershipPrivilege 2632 WMIC.exe Token: SeLoadDriverPrivilege 2632 WMIC.exe Token: SeSystemProfilePrivilege 2632 WMIC.exe Token: SeSystemtimePrivilege 2632 WMIC.exe Token: SeProfSingleProcessPrivilege 2632 WMIC.exe Token: SeIncBasePriorityPrivilege 2632 WMIC.exe Token: SeCreatePagefilePrivilege 2632 WMIC.exe Token: SeBackupPrivilege 2632 WMIC.exe Token: SeRestorePrivilege 2632 WMIC.exe Token: SeShutdownPrivilege 2632 WMIC.exe Token: SeDebugPrivilege 2632 WMIC.exe Token: SeSystemEnvironmentPrivilege 2632 WMIC.exe Token: SeRemoteShutdownPrivilege 2632 WMIC.exe Token: SeUndockPrivilege 2632 WMIC.exe Token: SeManageVolumePrivilege 2632 WMIC.exe Token: 33 2632 WMIC.exe Token: 34 2632 WMIC.exe Token: 35 2632 WMIC.exe Token: 36 2632 WMIC.exe Token: SeIncreaseQuotaPrivilege 2632 WMIC.exe Token: SeSecurityPrivilege 2632 WMIC.exe Token: SeTakeOwnershipPrivilege 2632 WMIC.exe Token: SeLoadDriverPrivilege 2632 WMIC.exe Token: SeSystemProfilePrivilege 2632 WMIC.exe Token: SeSystemtimePrivilege 2632 WMIC.exe Token: SeProfSingleProcessPrivilege 2632 WMIC.exe Token: SeIncBasePriorityPrivilege 2632 WMIC.exe Token: SeCreatePagefilePrivilege 2632 WMIC.exe Token: SeBackupPrivilege 2632 WMIC.exe Token: SeRestorePrivilege 2632 WMIC.exe Token: SeShutdownPrivilege 2632 WMIC.exe Token: SeDebugPrivilege 2632 WMIC.exe Token: SeSystemEnvironmentPrivilege 2632 WMIC.exe Token: SeRemoteShutdownPrivilege 2632 WMIC.exe Token: SeUndockPrivilege 2632 WMIC.exe Token: SeManageVolumePrivilege 2632 WMIC.exe Token: 33 2632 WMIC.exe Token: 34 2632 WMIC.exe Token: 35 2632 WMIC.exe Token: 36 2632 WMIC.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1132 rundll32.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2736 wrote to memory of 1132 2736 rundll32.exe 81 PID 2736 wrote to memory of 1132 2736 rundll32.exe 81 PID 2736 wrote to memory of 1132 2736 rundll32.exe 81 PID 1132 wrote to memory of 3044 1132 rundll32.exe 82 PID 1132 wrote to memory of 3044 1132 rundll32.exe 82 PID 1132 wrote to memory of 3044 1132 rundll32.exe 82 PID 3044 wrote to memory of 2632 3044 cmd.exe 85 PID 3044 wrote to memory of 2632 3044 cmd.exe 85 PID 3044 wrote to memory of 2632 3044 cmd.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a4556c5417ccafc24becd8a1716d242b0a8964d5562ff36a505ea9c3b068ffd3.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a4556c5417ccafc24becd8a1716d242b0a8964d5562ff36a505ea9c3b068ffd3.dll,#12⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\SysWOW64\cmd.execmd.exe /c wmic diskdrive get serialnumber3⤵
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic diskdrive get serialnumber4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2632
-
-
-