Analysis
-
max time kernel
0s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29/12/2023, 18:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
002198806d50395578e0aca60c800d4d.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
002198806d50395578e0aca60c800d4d.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
002198806d50395578e0aca60c800d4d.exe
-
Size
524KB
-
MD5
002198806d50395578e0aca60c800d4d
-
SHA1
d6aed7c31207794cd9ae4c622ee60f0cf55548e0
-
SHA256
b33a7db5418f251a088d041ccb8829b2624a1b8f0baed03e2f91bbb1986be52f
-
SHA512
85962632a949f8ddc49ae2382926b6cc22840e852103a6fb79cd6bbdbaf9e5ae76da6e86762a208b0b85f00561cff6e111a81aa8ef5e01e9d55e0cfacd129553
-
SSDEEP
12288:wxSFvG9JLDevovL1UTgkFJF6vgOCTLCe2f8gmAtI8hIc:eSFvG9JLqvE5UL6oJJk8r8h
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\system.bak 002198806d50395578e0aca60c800d4d.exe File created C:\Windows\SysWOW64\system.log 002198806d50395578e0aca60c800d4d.exe File opened for modification C:\Windows\SysWOW64\system.log 002198806d50395578e0aca60c800d4d.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2352 002198806d50395578e0aca60c800d4d.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2352 002198806d50395578e0aca60c800d4d.exe 2352 002198806d50395578e0aca60c800d4d.exe