Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231025-en -
resource tags
arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system -
submitted
08/12/2023, 07:23
Behavioral task
behavioral1
Sample
2485c24b6199fcc77071a57b77757d5832807f16517577640f8ad8d345e05b9a.exe
Resource
win7-20231025-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2485c24b6199fcc77071a57b77757d5832807f16517577640f8ad8d345e05b9a.exe
Resource
win10v2004-20231127-en
3 signatures
150 seconds
General
-
Target
2485c24b6199fcc77071a57b77757d5832807f16517577640f8ad8d345e05b9a.exe
-
Size
1.3MB
-
MD5
1d787662907fc3db6d12d7997661ec2a
-
SHA1
09ebc502f5a25ab1faf25be6a144ad56acc7eaf0
-
SHA256
2485c24b6199fcc77071a57b77757d5832807f16517577640f8ad8d345e05b9a
-
SHA512
58b37095d92ce2f893152e2338274b699e1f40b3596dca83d8fd6dde3d92519f1b6ef9de31059caa2eb0fbdfa131378b4ee2c7373486071bbf380b492b767371
-
SSDEEP
24576:RH5qQvHXcN71KSXPBPtmOJ5TUiRAGbJChHiK4kct9dK+6aVpNkeXgP:RHsQv3c3fzJ54iRAGNPKwXkjaHNb
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2228-1-0x0000000000400000-0x0000000000731000-memory.dmp vmprotect behavioral1/memory/2228-0-0x0000000000400000-0x0000000000731000-memory.dmp vmprotect behavioral1/memory/2228-5-0x0000000000400000-0x0000000000731000-memory.dmp vmprotect -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2228 2485c24b6199fcc77071a57b77757d5832807f16517577640f8ad8d345e05b9a.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2228 2485c24b6199fcc77071a57b77757d5832807f16517577640f8ad8d345e05b9a.exe 2228 2485c24b6199fcc77071a57b77757d5832807f16517577640f8ad8d345e05b9a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2485c24b6199fcc77071a57b77757d5832807f16517577640f8ad8d345e05b9a.exe"C:\Users\Admin\AppData\Local\Temp\2485c24b6199fcc77071a57b77757d5832807f16517577640f8ad8d345e05b9a.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2228