Analysis
-
max time kernel
119s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
02-10-2023 11:50
Static task
static1
Behavioral task
behavioral1
Sample
82ddc4754e1b1e2e877202f725d89726b8f4d909fc0a153234e3bb7e7a4a8b9f.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
82ddc4754e1b1e2e877202f725d89726b8f4d909fc0a153234e3bb7e7a4a8b9f.exe
Resource
win10v2004-20230915-en
General
-
Target
82ddc4754e1b1e2e877202f725d89726b8f4d909fc0a153234e3bb7e7a4a8b9f.exe
-
Size
3.9MB
-
MD5
5bc54b1323295686e57cb8f4bbfb934f
-
SHA1
193a9731fa3d2503202529c3335690f928597475
-
SHA256
82ddc4754e1b1e2e877202f725d89726b8f4d909fc0a153234e3bb7e7a4a8b9f
-
SHA512
dd86fc44b3ef776cbd85bebbe6a9c5bfdf8d15b13167192c900d1549969529016019b28e331ca216bad1ed632347b7d24d3863f860e08f51594d948d57d69eca
-
SSDEEP
98304:ABzjYz067yqu/mnFQOi33nFbO4KSgPTPgS8NAvKBUuY8cvwu3707iQMMvozFVrwO:J2vhBwM2dK
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2968 82ddc4754e1b1e2e877202f725d89726b8f4d909fc0a153234e3bb7e7a4a8b9f.exe 2968 82ddc4754e1b1e2e877202f725d89726b8f4d909fc0a153234e3bb7e7a4a8b9f.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2968 82ddc4754e1b1e2e877202f725d89726b8f4d909fc0a153234e3bb7e7a4a8b9f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\82ddc4754e1b1e2e877202f725d89726b8f4d909fc0a153234e3bb7e7a4a8b9f.exe"C:\Users\Admin\AppData\Local\Temp\82ddc4754e1b1e2e877202f725d89726b8f4d909fc0a153234e3bb7e7a4a8b9f.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2968