Analysis
-
max time kernel
1372s -
max time network
1167s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
24-09-2023 11:39
Behavioral task
behavioral1
Sample
sys.zip
Resource
win10v2004-20230915-en
0 signatures
1800 seconds
Behavioral task
behavioral2
Sample
Phemedrone.Tools.exe
Resource
win10v2004-20230915-en
0 signatures
1800 seconds
Behavioral task
behavioral3
Sample
⥪⮢ 㬥.txt
Resource
win10v2004-20230915-en
1 signatures
1800 seconds
General
-
Target
⥪⮢ 㬥.txt
-
Size
58B
-
MD5
a0f07f3ac987737b471b85ced9e676c3
-
SHA1
1675ceb4e042bb42c64da74bf5eda0e873112012
-
SHA256
3b1cd24f46f68e3a5982bdb8c1391988ac747a6cf66b8af32098882e8ede20eb
-
SHA512
801b432f2b43ce4148267df35c0c50c886342a830357330902ad046742e0c4b5ed38c597bf2bcdaf145ac937ec26a026f7a89cf0fe8aa4e4c910c46300d65385
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
svchost.exedescription pid process Token: SeManageVolumePrivilege 488 svchost.exe
Processes
-
C:\Windows\system32\NOTEPAD.EXEC:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\ ⥪⮢ 㬥.txt"1⤵PID:3120
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵PID:2952
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
PID:488