Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
15/11/2023, 09:59
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe
Resource
win7-20231023-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe
Resource
win10v2004-20231025-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe
-
Size
3.3MB
-
MD5
94e82c72afb84a86a6ef50ac512d1022
-
SHA1
e1f9cdba6bb6a99a4e782c087c8d0aea23b859b1
-
SHA256
ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050
-
SHA512
dc82704ddc2e213f107b559afbe73e592c43e35f490ff7f9a6c475759f446e3213420f3783803c9deab709f5d401b03336b566406dc78a75f4bd71e44c8a2439
-
SSDEEP
49152:AlZi1szYAvqaCPmcddUA7Btqvncaq+7ef6DHdd76C3bQOf5Pffca78HxWMNsbJoL:cZXYAvlcLN7BZ+7FRd76sQr8M6ou
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2784 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2784 powershell.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 312 wrote to memory of 2436 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 28 PID 312 wrote to memory of 2436 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 28 PID 312 wrote to memory of 2436 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 28 PID 312 wrote to memory of 2436 312 ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe 28 PID 2436 wrote to memory of 2784 2436 cmd.exe 30 PID 2436 wrote to memory of 2784 2436 cmd.exe 30 PID 2436 wrote to memory of 2784 2436 cmd.exe 30 PID 2436 wrote to memory of 2784 2436 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe"C:\Users\Admin\AppData\Local\Temp\ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ced8e0c88f5ee6ee84d6fa485c65c503c0ba6e0b0163f7367414e092a46ff050.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2784
-
-