Analysis
-
max time kernel
2s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/12/2023, 18:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0b51795bfee600ca87a5632c7d44792c.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
0b51795bfee600ca87a5632c7d44792c.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
0b51795bfee600ca87a5632c7d44792c.exe
-
Size
501KB
-
MD5
0b51795bfee600ca87a5632c7d44792c
-
SHA1
a40a3661b4b7634f07774fd15d8ca6e977f7bb46
-
SHA256
7dd1b26f7d13b353526295089b5ce5bc0abd6e3b7786d081f778cc0f9eb3f9a1
-
SHA512
57906a33dbaf0c823d0bb2c616cc3070692e92f8428e4d665f97fb7fc29efebb868c830a342005f42b893600b20e49dee9c95def6072838a427d657ffc695b2d
-
SSDEEP
12288:hy7anlVGg3mAgPo6XxkncSlrt2nApuw8zwtmAQ4R/GTLR:cgmAgPJBkncIrt2smwYABw1
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2008 0b51795bfee600ca87a5632c7d44792c.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2008 0b51795bfee600ca87a5632c7d44792c.exe Token: SeDebugPrivilege 2008 0b51795bfee600ca87a5632c7d44792c.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27 PID 2008 wrote to memory of 1260 2008 0b51795bfee600ca87a5632c7d44792c.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b51795bfee600ca87a5632c7d44792c.exe"C:\Users\Admin\AppData\Local\Temp\0b51795bfee600ca87a5632c7d44792c.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\0b51795bfee600ca87a5632c7d44792c.exeC:\Users\Admin\AppData\Local\Temp\0b51795bfee600ca87a5632c7d44792c.exe2⤵PID:2872
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵PID:1260
-