Analysis
-
max time kernel
142s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
05-10-2023 22:00
Static task
static1
Behavioral task
behavioral1
Sample
bdfcb81d29f5e37887a7bed805e80518fd3b869d4a0d18f1bc3f811c6ce0ceec.apk
Resource
android-x86-arm-20230831-en
Behavioral task
behavioral2
Sample
bdfcb81d29f5e37887a7bed805e80518fd3b869d4a0d18f1bc3f811c6ce0ceec.apk
Resource
android-x64-20230831-en
Behavioral task
behavioral3
Sample
bdfcb81d29f5e37887a7bed805e80518fd3b869d4a0d18f1bc3f811c6ce0ceec.apk
Resource
android-x64-arm64-20230831-en
Behavioral task
behavioral4
Sample
template.js
Resource
win7-20230831-en
Behavioral task
behavioral5
Sample
template.js
Resource
win10v2004-20230915-en
General
-
Target
template.js
-
Size
57KB
-
MD5
3fb68e15b065d895aa6657a11b204aa3
-
SHA1
db3259aa1e92e88ab13f81024cf307d5141a17b5
-
SHA256
dca976f8117c8b3abdb52a650198a1fd1b505e8e4c9a743800da3fbd3d8fd4d9
-
SHA512
cf3c645e71cd3ede2cc082c0742a74f2d1dd052fa55ca61af2ef2f64c24c82d2c336cf01eb860b95db486bb6116599dcda120f68d6dc7b11a31b0e93c3b26dae
-
SSDEEP
768:nxACdOCgErJCtrzlCz4xnceJtU6r0iBpTkM4TuDcpdd67Kn+b5ha8HbKMLsA1Owg:nx7ZqrzligDUyXkjw4n+yktg
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeManageVolumePrivilege 3620 svchost.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\template.js1⤵PID:4576
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵PID:4400
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3620