Analysis
-
max time kernel
126s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2023, 23:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe
Resource
win7-20230712-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe
-
Size
12.8MB
-
MD5
cc6c2ac4b640dce70c2c38756e3a42aa
-
SHA1
d8553f3031711253f767cc163e7ec7b07f3d085f
-
SHA256
5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b
-
SHA512
80cb88aa59151fec5433df0ffaad5dd2eeecbde74a9fa601a572469a7b72d1158a9df3fa6d4b18e95c9eddd53c9bbbc319bc2f31f42bad08b7caf268952e9686
-
SSDEEP
196608:HxlL1jlMZmNAfkIPJdwRbGMc9gLmb3s5Xjebzu2fba3TKzzJ59ZdQ8+0vbi:7L1jlMYqfHJdZMEg6bHu2TeT271bi
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4052-2-0x00000276E29B0000-0x00000276E4225000-memory.dmp vmprotect behavioral2/memory/4052-9-0x00000276E29B0000-0x00000276E4225000-memory.dmp vmprotect behavioral2/memory/4052-14-0x00000276E29B0000-0x00000276E4225000-memory.dmp vmprotect behavioral2/memory/4052-19-0x00000276E29B0000-0x00000276E4225000-memory.dmp vmprotect -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe 4052 RuntimeBroker.exe 4052 RuntimeBroker.exe 4052 RuntimeBroker.exe 4052 RuntimeBroker.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe Token: SeDebugPrivilege 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3064 wrote to memory of 3016 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe 83 PID 3064 wrote to memory of 3016 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe 83 PID 3064 wrote to memory of 4052 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe 60 PID 3064 wrote to memory of 4052 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe 60 PID 3064 wrote to memory of 4052 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe 60 PID 3064 wrote to memory of 4052 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe 60 PID 3064 wrote to memory of 4052 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe 60 PID 3064 wrote to memory of 4052 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe 60 PID 3064 wrote to memory of 4052 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe 60 PID 3064 wrote to memory of 4052 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe 60 PID 3064 wrote to memory of 4052 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe 60 PID 3064 wrote to memory of 4052 3064 5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe 60
Processes
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4052
-
C:\Users\Admin\AppData\Local\Temp\5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe"C:\Users\Admin\AppData\Local\Temp\5ae6069043fb807a89687612be2924466105994f5ef707e0852f5fae8f8e465b.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c color 1B2⤵PID:3016
-