Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 08:13
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
5ed8f9837590b396ee9bff40bcbc3fa5.exe
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
5ed8f9837590b396ee9bff40bcbc3fa5.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
5ed8f9837590b396ee9bff40bcbc3fa5.exe
-
Size
2.1MB
-
MD5
5ed8f9837590b396ee9bff40bcbc3fa5
-
SHA1
069d591fe884eef71cb6e04241d6ae2c70445239
-
SHA256
e6c05261c41c0c41f3ee4057bc82a976912c1e3ab763f96195dff657e2d8af27
-
SHA512
bd02dca890494efb02f6a7c976c469aa9f144af183080ecbafce5789d01d1e9d2ae608f15334766bd26b3d7d27aaa05cf9d4c1ea4a8ba0ce2f35554e32dbad03
-
SSDEEP
24576:DhJk21v84aY0tOyMfn2I6a281MNtv2g5y2cZ/HfMXLCYFLkgKB38Ug:Dhl1CuOHOmB2icZ/L6LkzP
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2420-1-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2420-4-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2420-3-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2420-5-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2420-7-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2420-6-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2420-9-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2420-12-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2420-14-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2420-16-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2420-18-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2420-20-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2420-23-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2420-25-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2420-28-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2420-30-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2420-33-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2420-35-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2420-40-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2420-38-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2420-42-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2420-44-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2420-46-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2420-48-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2420-50-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2420-53-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2420-66-0x0000000010000000-0x000000001003D000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main 5ed8f9837590b396ee9bff40bcbc3fa5.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: 33 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe Token: SeIncBasePriorityPrivilege 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe Token: 33 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe Token: SeIncBasePriorityPrivilege 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe Token: 33 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe Token: SeIncBasePriorityPrivilege 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe Token: 33 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe Token: SeIncBasePriorityPrivilege 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe Token: 33 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe Token: SeIncBasePriorityPrivilege 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe Token: 33 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe Token: SeIncBasePriorityPrivilege 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe Token: 33 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe Token: SeIncBasePriorityPrivilege 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe Token: 33 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe Token: SeIncBasePriorityPrivilege 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe Token: 33 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe Token: SeIncBasePriorityPrivilege 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe Token: 33 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe Token: SeIncBasePriorityPrivilege 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe Token: 33 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe Token: SeIncBasePriorityPrivilege 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe Token: 33 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe Token: SeIncBasePriorityPrivilege 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe Token: 33 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe Token: SeIncBasePriorityPrivilege 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe Token: 33 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe Token: SeIncBasePriorityPrivilege 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe Token: 33 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe Token: SeIncBasePriorityPrivilege 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe Token: 33 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe Token: SeIncBasePriorityPrivilege 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe Token: 33 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe Token: SeIncBasePriorityPrivilege 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe Token: 33 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe Token: SeIncBasePriorityPrivilege 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe Token: 33 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe Token: SeIncBasePriorityPrivilege 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe Token: 33 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe Token: SeIncBasePriorityPrivilege 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe Token: 33 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe Token: SeIncBasePriorityPrivilege 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe Token: 33 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe Token: SeIncBasePriorityPrivilege 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe Token: 33 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe Token: SeIncBasePriorityPrivilege 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe 2420 5ed8f9837590b396ee9bff40bcbc3fa5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ed8f9837590b396ee9bff40bcbc3fa5.exe"C:\Users\Admin\AppData\Local\Temp\5ed8f9837590b396ee9bff40bcbc3fa5.exe"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2420