Analysis
-
max time kernel
118s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
12-10-2023 14:12
Behavioral task
behavioral1
Sample
21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe
Resource
win7-20230831-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe
-
Size
4.0MB
-
MD5
2df3cacfbcf994f75d5fb72465c0144e
-
SHA1
a4cb5b9859baaa442934c140291a7dab0e855767
-
SHA256
21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589
-
SHA512
c4b83139118bcb98aa575f0c716c754e3e9366c8c39f1a96148ce658c4b49cedd5ebb059bb73daef3a7067b133de38bc2977b1c8c1a1c3d4586eed7c46af718a
-
SSDEEP
98304:XsTzzwM1HxwX6bY7kl9oLCqq6JJBAUZLD:XgcKb+JJV/
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeDebugPrivilege 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: 1 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: SeCreateTokenPrivilege 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: SeAssignPrimaryTokenPrivilege 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: SeLockMemoryPrivilege 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: SeIncreaseQuotaPrivilege 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: SeMachineAccountPrivilege 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: SeTcbPrivilege 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: SeSecurityPrivilege 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: SeTakeOwnershipPrivilege 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: SeLoadDriverPrivilege 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: SeSystemProfilePrivilege 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: SeSystemtimePrivilege 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: SeProfSingleProcessPrivilege 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: SeIncBasePriorityPrivilege 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: SeCreatePagefilePrivilege 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: SeCreatePermanentPrivilege 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: SeBackupPrivilege 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: SeRestorePrivilege 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: SeShutdownPrivilege 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: SeDebugPrivilege 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: SeAuditPrivilege 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: SeSystemEnvironmentPrivilege 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: SeChangeNotifyPrivilege 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: SeRemoteShutdownPrivilege 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: SeUndockPrivilege 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: SeSyncAgentPrivilege 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: SeEnableDelegationPrivilege 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: SeManageVolumePrivilege 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: SeImpersonatePrivilege 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: SeCreateGlobalPrivilege 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: 31 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: 32 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: 33 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: 34 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: 35 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: 36 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: 37 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: 38 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: 39 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: 40 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: 41 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: 42 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: 43 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: 44 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: 45 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: 46 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: 47 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe Token: 48 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe 1736 21f648b31edf4bb953203b7ce7fcd7b5b04d7357790cf89ce0c7bb72d6d69589.exe