Analysis
-
max time kernel
143s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
12-10-2023 00:09
Static task
static1
Behavioral task
behavioral1
Sample
b7da8caf86e7b7db84d180527362a943c7df4e618b2ccf7475b68574c782e216.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
b7da8caf86e7b7db84d180527362a943c7df4e618b2ccf7475b68574c782e216.exe
Resource
win10v2004-20230915-en
General
-
Target
b7da8caf86e7b7db84d180527362a943c7df4e618b2ccf7475b68574c782e216.exe
-
Size
15.9MB
-
MD5
cd37de7980adc08c23e3e6f9fa0756c7
-
SHA1
df309eeb9fa347df3b2e183f0e9e4c73563c2ebe
-
SHA256
b7da8caf86e7b7db84d180527362a943c7df4e618b2ccf7475b68574c782e216
-
SHA512
34960185b64d6951f79c977947c11b6ca7f1c772d0cdd9a6e6235a6f60b3a0e78df1c7da74f2e18544acf60b2a090aa0c535cb78e8f01cf56692857c3f5f29ee
-
SSDEEP
393216:Ia9wat5PHyghi2XR8ZtRGb5sgK/sVICfeNCiuBSN2U354Ym:D6ePSg4fZmb+gBteYi1X54H
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2068 b7da8caf86e7b7db84d180527362a943c7df4e618b2ccf7475b68574c782e216.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2068 b7da8caf86e7b7db84d180527362a943c7df4e618b2ccf7475b68574c782e216.exe 2068 b7da8caf86e7b7db84d180527362a943c7df4e618b2ccf7475b68574c782e216.exe 2068 b7da8caf86e7b7db84d180527362a943c7df4e618b2ccf7475b68574c782e216.exe 2068 b7da8caf86e7b7db84d180527362a943c7df4e618b2ccf7475b68574c782e216.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7da8caf86e7b7db84d180527362a943c7df4e618b2ccf7475b68574c782e216.exe"C:\Users\Admin\AppData\Local\Temp\b7da8caf86e7b7db84d180527362a943c7df4e618b2ccf7475b68574c782e216.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2068
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD517e6f4601823baead5f7ef5ccebfa369
SHA14b87f43caa75a357d5feae1e33f16b9b9d605978
SHA256984efaed8675dd5e4b47172f65fb3864681d000058099944ac7ad198b2bd9724
SHA51201d9ada5ed16e81ca6243a25bfa6b1b99a9a6a101b25552a972829307d009e174f6869181bf13f0ad2bb537c83cec48bb9fa073b852dbe85d504cf3586e4b609
-
Filesize
1KB
MD5ed03bb14766efae019dd793b1e6d03e1
SHA19e9e6520ef0fca947927f3eef5c5d8039ef23c5f
SHA256c145897d21b90d0d55d15b34c26903f8cde2998906d50f91ddaea7c40e5ed457
SHA5126f8a6f556b88b2af84677c80fc871502b1e7faee81706d67fe9d23dc8d28ead9f86058d95285759a438f969ab4520a319676b439164cb7fe5f5cdb7c6e15495e
-
C:\Users\Admin\AppData\Local\Temp\b7da8caf86e7b7db84d180527362a943c7df4e618b2ccf7475b68574c782e216.exepack.tmp
Filesize2KB
MD5b39472bab08b68b10900f005cc76526f
SHA11fbdfe7a1d9a0bb4cdea5c4c929c4e2c7ee405c5
SHA256b3490631ddcb693cdae67f59691d23f3b54a0bd47f3155a12c5aba26bfced88c
SHA5129f48909ec7af8a74c359db702bf20bc6e7f630258ffec46d7237050731fe7a8aa29d12fa200225c2ab533dae4820df893a98836ee6377e4c9b775c53c72a2931