Analysis
-
max time kernel
48s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2023, 18:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0085e5f6785380f95eebbac8d3a12752.exe
Resource
win7-20231215-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
0085e5f6785380f95eebbac8d3a12752.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
0085e5f6785380f95eebbac8d3a12752.exe
-
Size
1.8MB
-
MD5
0085e5f6785380f95eebbac8d3a12752
-
SHA1
1bae96894fa2c8c8c254833472edcbed478f07e3
-
SHA256
e0fd823659000f46f7e54f839629144be462919a31a5e258f13b2b79731aa6cf
-
SHA512
d834e50b17acb2d1012991c1721e9a3b5eb5e7491cc1a387d22392e836072995f12b67688a3b084199f92734f4fe5566fe35ef329f0f4c655e335c1adbc9feeb
-
SSDEEP
49152:QcoypeOo2hCyW2aEIknrpJwjiadPBO1Q7fKvgRoML:Q5WEge2aE7nnadU1mDR9L
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1200 0085e5f6785380f95eebbac8d3a12752.exe Token: SeDebugPrivilege 1200 0085e5f6785380f95eebbac8d3a12752.exe Token: SeDebugPrivilege 1200 0085e5f6785380f95eebbac8d3a12752.exe Token: SeDebugPrivilege 1200 0085e5f6785380f95eebbac8d3a12752.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1200 0085e5f6785380f95eebbac8d3a12752.exe 1200 0085e5f6785380f95eebbac8d3a12752.exe