Analysis
-
max time kernel
152s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
12-10-2023 05:43
Static task
static1
Behavioral task
behavioral1
Sample
6e6b14f06c3167641c0dfd6be4aab2716cb8489647241eba89bfd25b3be306f9.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
6e6b14f06c3167641c0dfd6be4aab2716cb8489647241eba89bfd25b3be306f9.exe
Resource
win10v2004-20230915-en
General
-
Target
6e6b14f06c3167641c0dfd6be4aab2716cb8489647241eba89bfd25b3be306f9.exe
-
Size
7.4MB
-
MD5
2f6e69894dca46774c9f6a4a49ac3e8f
-
SHA1
3f96c2c3fe0775982518242e5f4cd1ec55eb18f1
-
SHA256
6e6b14f06c3167641c0dfd6be4aab2716cb8489647241eba89bfd25b3be306f9
-
SHA512
dd7c1bc2d082df17a2f490c074a152961084b154e1713a8fd8589a18c6669d6b70abc3d92e12480fef00815823104cfef36b709873fc55d61b4191a2870e0300
-
SSDEEP
196608:T1z/Z5PZ6NS3XophlBVDHqwbhVaBV13rtWjev2JVzA:OhT9HqEDrD
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeSystemtimePrivilege 1756 6e6b14f06c3167641c0dfd6be4aab2716cb8489647241eba89bfd25b3be306f9.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1756 6e6b14f06c3167641c0dfd6be4aab2716cb8489647241eba89bfd25b3be306f9.exe 1756 6e6b14f06c3167641c0dfd6be4aab2716cb8489647241eba89bfd25b3be306f9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e6b14f06c3167641c0dfd6be4aab2716cb8489647241eba89bfd25b3be306f9.exe"C:\Users\Admin\AppData\Local\Temp\6e6b14f06c3167641c0dfd6be4aab2716cb8489647241eba89bfd25b3be306f9.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1756
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD579885db374c11448bb4590913165a2fb
SHA174a311dcba5c17a4a9afba30fd424068dc57e5ad
SHA256b56343ab0a9d260938fa80ed3f96a53a676203cda7aa90f2939cbc53f61b2e7a
SHA512bd129f5a09535db0895257242a8232165a28adcaae668f5c21cae5ea0603f6cc6e45ed2a33a3f19f5c1c40c7bcde6e7c1cf1eaf4827a5785133d7b869a399f45
-
Filesize
3KB
MD57eae789b9c9cfeee67b4df186b283cb1
SHA1975641764a693c651027b9fde4158461e2c41b2c
SHA25603290a3e6ac464f1eb99ccc49c5d79943879045f0702adef352466384b585a78
SHA512c045e5263c62751a86f79ac692745adbf457be50d1c8a43a08bf5dd549f583a53f5fcddf1ca5df5398d696aeca780f569dd7db4facde99e392ab204b69df60cf
-
Filesize
642B
MD5bbe24867001a7f25ca3c459417e64b53
SHA18ebd60a951b5b0b981a0f573d8caa4a17f9dad85
SHA256ff7c0ecf544bae7bcb50f095e5fdeb694aa6a541e7f682433face55329b76514
SHA5127a755317cedde1d224d346432a14219c983ff62596a49876e37027c71dbf8614d0378633cfbd9f0817d59eb4f4c94ec2e2a60be10a70bde9c1e3e9b962ca4ccb
-
Filesize
3KB
MD5d29a379ef3e96cffb1a185a9e4fe3db5
SHA1df6944d2835d498cc0c138c6a089052c0e04760b
SHA25631440fa6ad110448d4ff3cebfeb43ffe8654f499e1c55d0a3b140bbe1430add5
SHA512ffed27cec0b46e36a8f15a682983a0c6e163e3006aba4e9c60bf47d6769e0e76239cdd6679f335424a40c46ccf6660f7dd0187a09bb64136e3b78ef5098803a7