Analysis
-
max time kernel
142s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
20/09/2023, 00:07
Static task
static1
Behavioral task
behavioral1
Sample
e0dd986c8547a7ebf020b76f0344c5aedfb63e9f2d2e53fa5ab35fca777446ea.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
e0dd986c8547a7ebf020b76f0344c5aedfb63e9f2d2e53fa5ab35fca777446ea.exe
Resource
win10v2004-20230915-en
General
-
Target
e0dd986c8547a7ebf020b76f0344c5aedfb63e9f2d2e53fa5ab35fca777446ea.exe
-
Size
6.4MB
-
MD5
201702b6a14e57c945ea5c32dc3ba000
-
SHA1
9b49eef2cafdf65826e0da912f3e366049b747cd
-
SHA256
e0dd986c8547a7ebf020b76f0344c5aedfb63e9f2d2e53fa5ab35fca777446ea
-
SHA512
5c49838c3fe9783ab456ca244dcc2ac544442f291d6b8c65aabd2caf8c3cc1d9ab8a058d9e08bb7d62616b6c6924e34fa9e15254b20e25750e2e4aa3a6dd7565
-
SSDEEP
98304:qvlXCX64qI7ZNlVJ7VxCN1iU/C8upuH/7DGuXY4P2eez2DzogFpPvH:2IXlRxXHNu/Wz2v/
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 2936 e0dd986c8547a7ebf020b76f0344c5aedfb63e9f2d2e53fa5ab35fca777446ea.exe Token: SeIncBasePriorityPrivilege 2936 e0dd986c8547a7ebf020b76f0344c5aedfb63e9f2d2e53fa5ab35fca777446ea.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2936 e0dd986c8547a7ebf020b76f0344c5aedfb63e9f2d2e53fa5ab35fca777446ea.exe 2936 e0dd986c8547a7ebf020b76f0344c5aedfb63e9f2d2e53fa5ab35fca777446ea.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2936 e0dd986c8547a7ebf020b76f0344c5aedfb63e9f2d2e53fa5ab35fca777446ea.exe 2936 e0dd986c8547a7ebf020b76f0344c5aedfb63e9f2d2e53fa5ab35fca777446ea.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2936 e0dd986c8547a7ebf020b76f0344c5aedfb63e9f2d2e53fa5ab35fca777446ea.exe 2936 e0dd986c8547a7ebf020b76f0344c5aedfb63e9f2d2e53fa5ab35fca777446ea.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0dd986c8547a7ebf020b76f0344c5aedfb63e9f2d2e53fa5ab35fca777446ea.exe"C:\Users\Admin\AppData\Local\Temp\e0dd986c8547a7ebf020b76f0344c5aedfb63e9f2d2e53fa5ab35fca777446ea.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2936