Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
02/09/2023, 08:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe
Resource
win7-20230831-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe
Resource
win10v2004-20230831-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe
-
Size
1.5MB
-
MD5
dbe27e029702740f315b6eb4978bf9ff
-
SHA1
cda2f02913d7e21ab111d2bf69c882e4d7ff7293
-
SHA256
80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2
-
SHA512
9ad9ce8d76e3b3ea91dddee631c0394ccb33561dd0f95c50758dcd3ccc2fc85a8a96248f56e71988e0f2c0667f7e9f8ab0973d469a605ad0468c47c7df79a6db
-
SSDEEP
24576:njlSDbalFfj1UIc8KJC4nckiH5XSwWWbEplKYtl+dLC40Q503iyz:nPjZKJbtiZC9WwpL+6Q
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3152-7-0x0000000002540000-0x000000000257E000-memory.dmp upx behavioral2/memory/3152-8-0x0000000002540000-0x000000000257E000-memory.dmp upx behavioral2/memory/3152-9-0x0000000002540000-0x000000000257E000-memory.dmp upx behavioral2/memory/3152-10-0x0000000002540000-0x000000000257E000-memory.dmp upx behavioral2/memory/3152-12-0x0000000002540000-0x000000000257E000-memory.dmp upx behavioral2/memory/3152-14-0x0000000002540000-0x000000000257E000-memory.dmp upx behavioral2/memory/3152-16-0x0000000002540000-0x000000000257E000-memory.dmp upx behavioral2/memory/3152-18-0x0000000002540000-0x000000000257E000-memory.dmp upx behavioral2/memory/3152-20-0x0000000002540000-0x000000000257E000-memory.dmp upx behavioral2/memory/3152-22-0x0000000002540000-0x000000000257E000-memory.dmp upx behavioral2/memory/3152-24-0x0000000002540000-0x000000000257E000-memory.dmp upx behavioral2/memory/3152-26-0x0000000002540000-0x000000000257E000-memory.dmp upx behavioral2/memory/3152-29-0x0000000002540000-0x000000000257E000-memory.dmp upx behavioral2/memory/3152-31-0x0000000002540000-0x000000000257E000-memory.dmp upx behavioral2/memory/3152-33-0x0000000002540000-0x000000000257E000-memory.dmp upx behavioral2/memory/3152-35-0x0000000002540000-0x000000000257E000-memory.dmp upx behavioral2/memory/3152-37-0x0000000002540000-0x000000000257E000-memory.dmp upx behavioral2/memory/3152-39-0x0000000002540000-0x000000000257E000-memory.dmp upx behavioral2/memory/3152-41-0x0000000002540000-0x000000000257E000-memory.dmp upx behavioral2/memory/3152-43-0x0000000002540000-0x000000000257E000-memory.dmp upx behavioral2/memory/3152-45-0x0000000002540000-0x000000000257E000-memory.dmp upx behavioral2/memory/3152-47-0x0000000002540000-0x000000000257E000-memory.dmp upx behavioral2/memory/3152-49-0x0000000002540000-0x000000000257E000-memory.dmp upx behavioral2/memory/3152-51-0x0000000002540000-0x000000000257E000-memory.dmp upx behavioral2/memory/3152-52-0x0000000002540000-0x000000000257E000-memory.dmp upx -
Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeDebugPrivilege 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: 1 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: SeCreateTokenPrivilege 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: SeAssignPrimaryTokenPrivilege 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: SeLockMemoryPrivilege 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: SeIncreaseQuotaPrivilege 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: SeMachineAccountPrivilege 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: SeTcbPrivilege 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: SeSecurityPrivilege 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: SeTakeOwnershipPrivilege 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: SeLoadDriverPrivilege 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: SeSystemProfilePrivilege 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: SeSystemtimePrivilege 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: SeProfSingleProcessPrivilege 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: SeIncBasePriorityPrivilege 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: SeCreatePagefilePrivilege 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: SeCreatePermanentPrivilege 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: SeBackupPrivilege 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: SeRestorePrivilege 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: SeShutdownPrivilege 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: SeDebugPrivilege 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: SeAuditPrivilege 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: SeSystemEnvironmentPrivilege 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: SeChangeNotifyPrivilege 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: SeRemoteShutdownPrivilege 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: SeUndockPrivilege 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: SeSyncAgentPrivilege 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: SeEnableDelegationPrivilege 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: SeManageVolumePrivilege 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: SeImpersonatePrivilege 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: SeCreateGlobalPrivilege 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: 31 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: 32 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: 33 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: 34 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: 35 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: 36 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: 37 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: 38 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: 39 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: 40 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: 41 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: 42 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: 43 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: 44 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: 45 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: 46 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: 47 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe Token: 48 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe 3152 80a665d3cd0c97454f4017b200a446b9d308692a370fc8298c7e9ac24dac61d2.exe