Analysis
-
max time kernel
141s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 13:57
Behavioral task
behavioral1
Sample
1abfd163b050ff0513ef93264f5803ed.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
1abfd163b050ff0513ef93264f5803ed.exe
Resource
win10v2004-20231215-en
4 signatures
150 seconds
General
-
Target
1abfd163b050ff0513ef93264f5803ed.exe
-
Size
644KB
-
MD5
1abfd163b050ff0513ef93264f5803ed
-
SHA1
7d0e7e1098c01e635a927d73bc60212e73e13396
-
SHA256
3c488eed0cfdac2c80195a12cd9973683e5aef5dc22db077a3ca32a050fa67e3
-
SHA512
5643d6ccddbd3e91e3e6db83fb7c1471655b59f018e1ee562db723127afa778a661753b14e5f3bc9bd62acc969c05064d6fc2efd2682ffd7325ab82d65a4b555
-
SSDEEP
6144:rPB97Lf660SMGiZwNC05hic0P7WENudQdxJdWgcGa30+NsWFZSAZ2KjIEs7jSAn0:LV0SMwNL56P7d48d+SAwyIdS0M8M
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\TesSafe.sys 1abfd163b050ff0513ef93264f5803ed.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 472 Process not Found -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 832 1abfd163b050ff0513ef93264f5803ed.exe Token: SeLoadDriverPrivilege 832 1abfd163b050ff0513ef93264f5803ed.exe