Analysis
- max time kernel
142s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system - submitted
21/09/2023, 03:18
Behavioral task
behavioral1
Sample
edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe
Resource
win7-20230831-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe
- Size 14.0MB
- Sample230921-dtz7laef53
- SHA256 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e
- MD5 0fb0cce8f194c5195e0a8a171f58e1e6
- SHA1 534d4600c4e6b46ffaec38f175e904d59d0f8c30
- SHA512 52327af84ca0e45c0d0faec46be14b22344840ea26542b627317e5ea235b7df0f790af21baf12d028a693a51433b00ac9e4cc27271375eec82712797a7ed5590
- SSDEEP 393216:Go9EDOUqjyJEQCsuundqJq2lbEiz94VABM:Go9bjuJXFjndqJq2lSVAa
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2620-4-0x0000000000400000-0x00000000020BF000-memory.dmp vmprotect behavioral2/memory/2620-9-0x0000000000400000-0x00000000020BF000-memory.dmp vmprotect behavioral2/memory/2620-23-0x0000000000400000-0x00000000020BF000-memory.dmp vmprotect behavioral2/memory/2620-24-0x0000000000400000-0x00000000020BF000-memory.dmp vmprotect - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe - Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeDebugPrivilege 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: 1 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: SeCreateTokenPrivilege 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: SeAssignPrimaryTokenPrivilege 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: SeLockMemoryPrivilege 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: SeIncreaseQuotaPrivilege 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: SeMachineAccountPrivilege 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: SeTcbPrivilege 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: SeSecurityPrivilege 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: SeTakeOwnershipPrivilege 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: SeLoadDriverPrivilege 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: SeSystemProfilePrivilege 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: SeSystemtimePrivilege 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: SeProfSingleProcessPrivilege 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: SeIncBasePriorityPrivilege 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: SeCreatePagefilePrivilege 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: SeCreatePermanentPrivilege 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: SeBackupPrivilege 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: SeRestorePrivilege 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: SeShutdownPrivilege 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: SeDebugPrivilege 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: SeAuditPrivilege 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: SeSystemEnvironmentPrivilege 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: SeChangeNotifyPrivilege 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: SeRemoteShutdownPrivilege 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: SeUndockPrivilege 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: SeSyncAgentPrivilege 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: SeEnableDelegationPrivilege 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: SeManageVolumePrivilege 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: SeImpersonatePrivilege 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: SeCreateGlobalPrivilege 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: 31 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: 32 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: 33 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: 34 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: 35 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: 36 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: 37 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: 38 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: 39 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: 40 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: 41 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: 42 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: 43 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: 44 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: 45 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: 46 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: 47 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe Token: 48 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe 2620 edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe"C:\Users\Admin\AppData\Local\Temp\edd0b1902c3a640e33ceb6f70a58af27e6f31b44bc9faeca83b6a5d6f606c81e.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2620