Analysis
-
max time kernel
139s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
21-11-2023 00:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe
Resource
win7-20231020-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe
-
Size
2.2MB
-
MD5
49d394f6ebefdd0e46f4ab5e4f2947f0
-
SHA1
f520ca5a60719b1dfb2e98521119e87fb13ba165
-
SHA256
1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee
-
SHA512
d52ff28b7a87feadab0773b30090fa0b400be4395201d0e553af6d738e1d503e0cd7b24e21c1f5d10bfdc466691c7e0d5670fb742db3bd6dd61c821da3d8ea55
-
SSDEEP
24576:z91pA+3AM8hHvEXRxnZgAfbytgMBJzuXpNAVNig9pgNeSb5plKYtl+dLA40Q5mUP:xuwRPfbgJzqAfJiNeSlpL+YQE9rj+B
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1780-7-0x0000000002660000-0x000000000269E000-memory.dmp upx behavioral2/memory/1780-9-0x0000000002660000-0x000000000269E000-memory.dmp upx behavioral2/memory/1780-10-0x0000000002660000-0x000000000269E000-memory.dmp upx behavioral2/memory/1780-11-0x0000000002660000-0x000000000269E000-memory.dmp upx behavioral2/memory/1780-12-0x0000000002660000-0x000000000269E000-memory.dmp upx behavioral2/memory/1780-13-0x0000000002660000-0x000000000269E000-memory.dmp upx behavioral2/memory/1780-17-0x0000000002660000-0x000000000269E000-memory.dmp upx behavioral2/memory/1780-15-0x0000000002660000-0x000000000269E000-memory.dmp upx behavioral2/memory/1780-20-0x0000000002660000-0x000000000269E000-memory.dmp upx behavioral2/memory/1780-22-0x0000000002660000-0x000000000269E000-memory.dmp upx behavioral2/memory/1780-25-0x0000000002660000-0x000000000269E000-memory.dmp upx behavioral2/memory/1780-29-0x0000000002660000-0x000000000269E000-memory.dmp upx behavioral2/memory/1780-31-0x0000000002660000-0x000000000269E000-memory.dmp upx behavioral2/memory/1780-38-0x0000000002660000-0x000000000269E000-memory.dmp upx behavioral2/memory/1780-35-0x0000000002660000-0x000000000269E000-memory.dmp upx behavioral2/memory/1780-33-0x0000000002660000-0x000000000269E000-memory.dmp upx behavioral2/memory/1780-27-0x0000000002660000-0x000000000269E000-memory.dmp upx behavioral2/memory/1780-41-0x0000000002660000-0x000000000269E000-memory.dmp upx behavioral2/memory/1780-48-0x0000000002660000-0x000000000269E000-memory.dmp upx behavioral2/memory/1780-51-0x0000000002660000-0x000000000269E000-memory.dmp upx behavioral2/memory/1780-59-0x0000000002660000-0x000000000269E000-memory.dmp upx behavioral2/memory/1780-62-0x0000000002660000-0x000000000269E000-memory.dmp upx behavioral2/memory/1780-57-0x0000000002660000-0x000000000269E000-memory.dmp upx behavioral2/memory/1780-63-0x0000000002660000-0x000000000269E000-memory.dmp upx behavioral2/memory/1780-55-0x0000000002660000-0x000000000269E000-memory.dmp upx behavioral2/memory/1780-53-0x0000000002660000-0x000000000269E000-memory.dmp upx behavioral2/memory/1780-44-0x0000000002660000-0x000000000269E000-memory.dmp upx behavioral2/memory/1780-64-0x0000000002660000-0x000000000269E000-memory.dmp upx -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe -
Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeDebugPrivilege 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: 1 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeCreateTokenPrivilege 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeAssignPrimaryTokenPrivilege 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeLockMemoryPrivilege 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeIncreaseQuotaPrivilege 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeMachineAccountPrivilege 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeTcbPrivilege 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeSecurityPrivilege 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeTakeOwnershipPrivilege 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeLoadDriverPrivilege 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeSystemProfilePrivilege 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeSystemtimePrivilege 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeProfSingleProcessPrivilege 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeIncBasePriorityPrivilege 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeCreatePagefilePrivilege 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeCreatePermanentPrivilege 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeBackupPrivilege 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeRestorePrivilege 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeShutdownPrivilege 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeDebugPrivilege 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeAuditPrivilege 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeSystemEnvironmentPrivilege 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeChangeNotifyPrivilege 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeRemoteShutdownPrivilege 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeUndockPrivilege 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeSyncAgentPrivilege 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeEnableDelegationPrivilege 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeManageVolumePrivilege 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeImpersonatePrivilege 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: SeCreateGlobalPrivilege 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: 31 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: 32 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: 33 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: 34 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: 35 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: 36 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: 37 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: 38 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: 39 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: 40 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: 41 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: 42 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: 43 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: 44 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: 45 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: 46 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: 47 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe Token: 48 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe 1780 1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe"C:\Users\Admin\AppData\Local\Temp\1704e7b7f7603cac73b14c9a398ab8dc629df4ddf9159e25b1e4d12515c13bee.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1780