Analysis
-
max time kernel
142s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2023 17:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
81f06f19f54142c5c5d2c7c80c3400b1.exe
Resource
win7-20231129-en
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
81f06f19f54142c5c5d2c7c80c3400b1.exe
Resource
win10v2004-20231222-en
2 signatures
150 seconds
General
-
Target
81f06f19f54142c5c5d2c7c80c3400b1.exe
-
Size
350KB
-
MD5
81f06f19f54142c5c5d2c7c80c3400b1
-
SHA1
c7ffe298b230d891e7876161dbf2d4357a03c021
-
SHA256
87307f9cbe996ef6cfd171c70af3e84d556c9eaddbda28de135333d54b42422a
-
SHA512
fc3d8b1e208a5e15cb15eb2552b143d98ba9cf63e511f38b7e88510cc841a6b7b05a72f897c6c94eb3798195c6b16e9ddd594b70d5060463562fac17d01d1b4a
-
SSDEEP
6144:STudqNza21GkHrULM1XeH7U45fAg7Jrg6/v7yZiIk89CIag/n:Oud8a2wLMi5fAg7Jk6/vBTYCcf
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
81f06f19f54142c5c5d2c7c80c3400b1.exedescription pid process Token: SeDebugPrivilege 680 81f06f19f54142c5c5d2c7c80c3400b1.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
81f06f19f54142c5c5d2c7c80c3400b1.exedescription pid process target process PID 680 wrote to memory of 5072 680 81f06f19f54142c5c5d2c7c80c3400b1.exe 81f06f19f54142c5c5d2c7c80c3400b1.exe PID 680 wrote to memory of 5072 680 81f06f19f54142c5c5d2c7c80c3400b1.exe 81f06f19f54142c5c5d2c7c80c3400b1.exe PID 680 wrote to memory of 5072 680 81f06f19f54142c5c5d2c7c80c3400b1.exe 81f06f19f54142c5c5d2c7c80c3400b1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\81f06f19f54142c5c5d2c7c80c3400b1.exe"C:\Users\Admin\AppData\Local\Temp\81f06f19f54142c5c5d2c7c80c3400b1.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Users\Admin\AppData\Local\Temp\81f06f19f54142c5c5d2c7c80c3400b1.exeC:\Users\Admin\AppData\Local\Temp\81f06f19f54142c5c5d2c7c80c3400b1.exe2⤵PID:5072