Analysis
-
max time kernel
140s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
02-09-2023 02:21
Behavioral task
behavioral1
Sample
7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe
Resource
win7-20230831-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe
Resource
win10v2004-20230831-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe
-
Size
989KB
-
MD5
3f6ad879fc2a87e9dc752d0b26ab7c4a
-
SHA1
048cafa577a711e6702cb1bd80c5ca29ec77d8d0
-
SHA256
7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15
-
SHA512
d71ffe886413068a7b3178b0a90a4af996153bc46ad9800d763a4a7eeccb04c751928ef1f0f1e77180f7e8fcc1b158a2b38c3f0129683c78d50b0ecc420dcf98
-
SSDEEP
24576:SubVUCTKUpVUkFU4jCcpLTkH5KfqWAxPGeCQC+fz4Mmbq0SY:SubjTVRXpLTkHaqet+Sq0j
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2972-0-0x0000000000400000-0x0000000000646000-memory.dmp upx behavioral1/memory/2972-10-0x00000000750D0000-0x00000000751D0000-memory.dmp upx behavioral1/memory/2972-11-0x0000000000400000-0x0000000000646000-memory.dmp upx behavioral1/memory/2972-12-0x0000000000400000-0x0000000000646000-memory.dmp upx behavioral1/memory/2972-14-0x0000000000400000-0x0000000000646000-memory.dmp upx behavioral1/memory/2972-15-0x0000000000400000-0x0000000000646000-memory.dmp upx behavioral1/memory/2972-16-0x0000000000400000-0x0000000000646000-memory.dmp upx behavioral1/memory/2972-17-0x0000000000400000-0x0000000000646000-memory.dmp upx behavioral1/memory/2972-18-0x0000000000400000-0x0000000000646000-memory.dmp upx behavioral1/memory/2972-19-0x0000000000400000-0x0000000000646000-memory.dmp upx behavioral1/memory/2972-20-0x0000000000400000-0x0000000000646000-memory.dmp upx behavioral1/memory/2972-21-0x0000000000400000-0x0000000000646000-memory.dmp upx behavioral1/memory/2972-22-0x0000000000400000-0x0000000000646000-memory.dmp upx behavioral1/memory/2972-23-0x0000000000400000-0x0000000000646000-memory.dmp upx behavioral1/memory/2972-24-0x0000000000400000-0x0000000000646000-memory.dmp upx behavioral1/memory/2972-25-0x0000000000400000-0x0000000000646000-memory.dmp upx behavioral1/memory/2972-26-0x0000000000400000-0x0000000000646000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe -
Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeDebugPrivilege 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: 1 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: SeCreateTokenPrivilege 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: SeAssignPrimaryTokenPrivilege 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: SeLockMemoryPrivilege 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: SeIncreaseQuotaPrivilege 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: SeMachineAccountPrivilege 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: SeTcbPrivilege 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: SeSecurityPrivilege 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: SeTakeOwnershipPrivilege 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: SeLoadDriverPrivilege 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: SeSystemProfilePrivilege 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: SeSystemtimePrivilege 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: SeProfSingleProcessPrivilege 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: SeIncBasePriorityPrivilege 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: SeCreatePagefilePrivilege 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: SeCreatePermanentPrivilege 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: SeBackupPrivilege 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: SeRestorePrivilege 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: SeShutdownPrivilege 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: SeDebugPrivilege 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: SeAuditPrivilege 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: SeSystemEnvironmentPrivilege 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: SeChangeNotifyPrivilege 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: SeRemoteShutdownPrivilege 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: SeUndockPrivilege 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: SeSyncAgentPrivilege 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: SeEnableDelegationPrivilege 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: SeManageVolumePrivilege 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: SeImpersonatePrivilege 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: SeCreateGlobalPrivilege 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: 31 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: 32 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: 33 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: 34 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: 35 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: 36 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: 37 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: 38 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: 39 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: 40 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: 41 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: 42 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: 43 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: 44 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: 45 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: 46 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: 47 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe Token: 48 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe 2972 7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe"C:\Users\Admin\AppData\Local\Temp\7bc90cf6af8d0a67d012779bcca7312dd4f664e64bace2d9dbbed7fffa87ba15.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2972