Analysis
-
max time kernel
142s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
22/11/2023, 13:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe
Resource
win7-20231023-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe
Resource
win10v2004-20231020-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe
-
Size
3.9MB
-
MD5
3ab3559c94789ea6b991d79ca9fd038f
-
SHA1
50da580ac25f13a3a8d2ad96b7f3ea71f2aa0fab
-
SHA256
94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3
-
SHA512
a521cacf6d821ea7140991631af46c5ab223c7d1db17e316ad4a2463ce1ebb186cbd677a25ceb758289f7208abfe20a3d52042a70d9329b7d2a3b86efe16905a
-
SSDEEP
98304:niX8H1Ztj6NJRxHNyy+4cchP9fgQsHGVVZszx7nc0qe+lBodjOHJ7wDqSyyZaFpi:niX8H136NJRxHNyy+4cchP9fgQsHGVVA
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/5044-7-0x0000000002860000-0x000000000289E000-memory.dmp upx behavioral2/memory/5044-9-0x0000000002860000-0x000000000289E000-memory.dmp upx behavioral2/memory/5044-10-0x0000000002860000-0x000000000289E000-memory.dmp upx behavioral2/memory/5044-11-0x0000000002860000-0x000000000289E000-memory.dmp upx behavioral2/memory/5044-12-0x0000000002860000-0x000000000289E000-memory.dmp upx behavioral2/memory/5044-13-0x0000000002860000-0x000000000289E000-memory.dmp upx behavioral2/memory/5044-15-0x0000000002860000-0x000000000289E000-memory.dmp upx behavioral2/memory/5044-17-0x0000000002860000-0x000000000289E000-memory.dmp upx behavioral2/memory/5044-19-0x0000000002860000-0x000000000289E000-memory.dmp upx behavioral2/memory/5044-21-0x0000000002860000-0x000000000289E000-memory.dmp upx behavioral2/memory/5044-23-0x0000000002860000-0x000000000289E000-memory.dmp upx behavioral2/memory/5044-25-0x0000000002860000-0x000000000289E000-memory.dmp upx behavioral2/memory/5044-27-0x0000000002860000-0x000000000289E000-memory.dmp upx behavioral2/memory/5044-30-0x0000000002860000-0x000000000289E000-memory.dmp upx behavioral2/memory/5044-32-0x0000000002860000-0x000000000289E000-memory.dmp upx behavioral2/memory/5044-34-0x0000000002860000-0x000000000289E000-memory.dmp upx behavioral2/memory/5044-37-0x0000000002860000-0x000000000289E000-memory.dmp upx behavioral2/memory/5044-40-0x0000000002860000-0x000000000289E000-memory.dmp upx behavioral2/memory/5044-44-0x0000000002860000-0x000000000289E000-memory.dmp upx behavioral2/memory/5044-46-0x0000000002860000-0x000000000289E000-memory.dmp upx behavioral2/memory/5044-48-0x0000000002860000-0x000000000289E000-memory.dmp upx behavioral2/memory/5044-51-0x0000000002860000-0x000000000289E000-memory.dmp upx behavioral2/memory/5044-53-0x0000000002860000-0x000000000289E000-memory.dmp upx behavioral2/memory/5044-56-0x0000000002860000-0x000000000289E000-memory.dmp upx behavioral2/memory/5044-58-0x0000000002860000-0x000000000289E000-memory.dmp upx behavioral2/memory/5044-60-0x0000000002860000-0x000000000289E000-memory.dmp upx behavioral2/memory/5044-61-0x0000000002860000-0x000000000289E000-memory.dmp upx -
Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeDebugPrivilege 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: 1 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: SeCreateTokenPrivilege 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: SeAssignPrimaryTokenPrivilege 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: SeLockMemoryPrivilege 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: SeIncreaseQuotaPrivilege 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: SeMachineAccountPrivilege 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: SeTcbPrivilege 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: SeSecurityPrivilege 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: SeTakeOwnershipPrivilege 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: SeLoadDriverPrivilege 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: SeSystemProfilePrivilege 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: SeSystemtimePrivilege 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: SeProfSingleProcessPrivilege 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: SeIncBasePriorityPrivilege 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: SeCreatePagefilePrivilege 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: SeCreatePermanentPrivilege 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: SeBackupPrivilege 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: SeRestorePrivilege 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: SeShutdownPrivilege 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: SeDebugPrivilege 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: SeAuditPrivilege 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: SeSystemEnvironmentPrivilege 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: SeChangeNotifyPrivilege 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: SeRemoteShutdownPrivilege 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: SeUndockPrivilege 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: SeSyncAgentPrivilege 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: SeEnableDelegationPrivilege 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: SeManageVolumePrivilege 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: SeImpersonatePrivilege 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: SeCreateGlobalPrivilege 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: 31 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: 32 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: 33 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: 34 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: 35 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: 36 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: 37 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: 38 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: 39 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: 40 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: 41 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: 42 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: 43 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: 44 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: 45 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: 46 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: 47 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe Token: 48 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe 5044 94979cccfeb0c6e34c50d3e65cd73072b822c3b43b21fc2181c4d883a63930d3.exe