Analysis
-
max time kernel
122s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
31-10-2023 13:46
Static task
static1
Behavioral task
behavioral1
Sample
5a896b4dd805bd44919151f4f5067d4d37a9840eb42396ad8b74a739bb53c511.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
5a896b4dd805bd44919151f4f5067d4d37a9840eb42396ad8b74a739bb53c511.exe
Resource
win10v2004-20231025-en
General
-
Target
5a896b4dd805bd44919151f4f5067d4d37a9840eb42396ad8b74a739bb53c511.exe
-
Size
3.9MB
-
MD5
3465351d6fddfea2afe2f974c362d513
-
SHA1
8b4607df1ced245c58b01af0e736dbc66668b2a5
-
SHA256
5a896b4dd805bd44919151f4f5067d4d37a9840eb42396ad8b74a739bb53c511
-
SHA512
1f01e5bf1fe8e2d65200e56d1caa481ddf24f6e3571ee7769342053403b79fff21513a63407e0721ec5dbe5e80560aa27887e1ffdd0d5584d7b2c0df666d6907
-
SSDEEP
98304:aBzjYz067yqu/mnFQOi33nFbO4KSgPTPgS8NAvKBUuY8cvwu3707iQMMvozFVrw2:f2vhBwM2dK
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1984 5a896b4dd805bd44919151f4f5067d4d37a9840eb42396ad8b74a739bb53c511.exe 1984 5a896b4dd805bd44919151f4f5067d4d37a9840eb42396ad8b74a739bb53c511.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1984 5a896b4dd805bd44919151f4f5067d4d37a9840eb42396ad8b74a739bb53c511.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a896b4dd805bd44919151f4f5067d4d37a9840eb42396ad8b74a739bb53c511.exe"C:\Users\Admin\AppData\Local\Temp\5a896b4dd805bd44919151f4f5067d4d37a9840eb42396ad8b74a739bb53c511.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1984