Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
21/11/2023, 00:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe
Resource
win7-20231020-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe
-
Size
2.2MB
-
MD5
49d394f6ebefdd0e46f4ab5e4f2947f0
-
SHA1
f520ca5a60719b1dfb2e98521119e87fb13ba165
-
SHA256
1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee
-
SHA512
d52ff28b7a87feadab0773b30090fa0b400be4395201d0e553af6d738e1d503e0cd7b24e21c1f5d10bfdc466691c7e0d5670fb742db3bd6dd61c821da3d8ea55
-
SSDEEP
24576:z91pA+3AM8hHvEXRxnZgAfbytgMBJzuXpNAVNig9pgNeSb5plKYtl+dLA40Q5mUP:xuwRPfbgJzqAfJiNeSlpL+YQE9rj+B
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2172-8-0x00000000002B0000-0x00000000002EE000-memory.dmp upx behavioral1/memory/2172-10-0x00000000002B0000-0x00000000002EE000-memory.dmp upx behavioral1/memory/2172-12-0x00000000002B0000-0x00000000002EE000-memory.dmp upx behavioral1/memory/2172-13-0x00000000002B0000-0x00000000002EE000-memory.dmp upx behavioral1/memory/2172-20-0x00000000002B0000-0x00000000002EE000-memory.dmp upx behavioral1/memory/2172-25-0x00000000002B0000-0x00000000002EE000-memory.dmp upx behavioral1/memory/2172-23-0x00000000002B0000-0x00000000002EE000-memory.dmp upx behavioral1/memory/2172-28-0x00000000002B0000-0x00000000002EE000-memory.dmp upx behavioral1/memory/2172-32-0x00000000002B0000-0x00000000002EE000-memory.dmp upx behavioral1/memory/2172-34-0x00000000002B0000-0x00000000002EE000-memory.dmp upx behavioral1/memory/2172-38-0x00000000002B0000-0x00000000002EE000-memory.dmp upx behavioral1/memory/2172-40-0x00000000002B0000-0x00000000002EE000-memory.dmp upx behavioral1/memory/2172-44-0x00000000002B0000-0x00000000002EE000-memory.dmp upx behavioral1/memory/2172-47-0x00000000002B0000-0x00000000002EE000-memory.dmp upx behavioral1/memory/2172-42-0x00000000002B0000-0x00000000002EE000-memory.dmp upx behavioral1/memory/2172-36-0x00000000002B0000-0x00000000002EE000-memory.dmp upx behavioral1/memory/2172-49-0x00000000002B0000-0x00000000002EE000-memory.dmp upx behavioral1/memory/2172-30-0x00000000002B0000-0x00000000002EE000-memory.dmp upx behavioral1/memory/2172-18-0x00000000002B0000-0x00000000002EE000-memory.dmp upx behavioral1/memory/2172-16-0x00000000002B0000-0x00000000002EE000-memory.dmp upx behavioral1/memory/2172-14-0x00000000002B0000-0x00000000002EE000-memory.dmp upx behavioral1/memory/2172-11-0x00000000002B0000-0x00000000002EE000-memory.dmp upx behavioral1/memory/2172-51-0x00000000002B0000-0x00000000002EE000-memory.dmp upx behavioral1/memory/2172-53-0x00000000002B0000-0x00000000002EE000-memory.dmp upx behavioral1/memory/2172-55-0x00000000002B0000-0x00000000002EE000-memory.dmp upx behavioral1/memory/2172-57-0x00000000002B0000-0x00000000002EE000-memory.dmp upx behavioral1/memory/2172-58-0x00000000002B0000-0x00000000002EE000-memory.dmp upx -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe -
Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeDebugPrivilege 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: 1 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeCreateTokenPrivilege 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeAssignPrimaryTokenPrivilege 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeLockMemoryPrivilege 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeIncreaseQuotaPrivilege 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeMachineAccountPrivilege 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeTcbPrivilege 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeSecurityPrivilege 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeTakeOwnershipPrivilege 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeLoadDriverPrivilege 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeSystemProfilePrivilege 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeSystemtimePrivilege 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeProfSingleProcessPrivilege 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeIncBasePriorityPrivilege 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeCreatePagefilePrivilege 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeCreatePermanentPrivilege 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeBackupPrivilege 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeRestorePrivilege 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeShutdownPrivilege 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeDebugPrivilege 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeAuditPrivilege 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeSystemEnvironmentPrivilege 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeChangeNotifyPrivilege 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeRemoteShutdownPrivilege 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeUndockPrivilege 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeSyncAgentPrivilege 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeEnableDelegationPrivilege 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeManageVolumePrivilege 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeImpersonatePrivilege 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeCreateGlobalPrivilege 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: 31 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: 32 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: 33 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: 34 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: 35 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: 36 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: 37 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: 38 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: 39 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: 40 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: 41 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: 42 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: 43 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: 44 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: 45 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: 46 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: 47 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: 48 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe 2172 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe"C:\Users\Admin\AppData\Local\Temp\1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2172