Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
21/09/2023, 02:37
Behavioral task
behavioral1
Sample
fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe
Resource
win7-20230831-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe
-
Size
954KB
-
MD5
2100164df4325913a32ae6c12112b05d
-
SHA1
cc07412c212b3c9de0cc115a5d5e0e013cdde888
-
SHA256
fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d
-
SHA512
7ed7d8ed5a382985fc1697f99d551dd34475e62abc0d52b11e54393f7865789099ee0150c7c12d44951ed516c0ebcba33e6358dfff8e2623fc4893ab7050ae62
-
SSDEEP
24576:PMxzIaD5VDm6ZH0NxFAnk989NKfgRScSHxqV3U6Nqs:PczHDeg8/Ak98SfoScL
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe Token: SeIncBasePriorityPrivilege 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe Token: SeIncBasePriorityPrivilege 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe 1692 fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe"C:\Users\Admin\AppData\Local\Temp\fdfb0217e80d59f22ffae3fceab5c961fc34c983ff6d098f8923c585fc6c517d.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1692