Analysis
-
max time kernel
7s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 01:26
Behavioral task
behavioral1
Sample
07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe
-
Size
285KB
-
MD5
52e19869afa06e2c49565ecd3c128556
-
SHA1
62f6c7115ede04428c75699ffa75ae40deff4203
-
SHA256
07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2
-
SHA512
09e769a9c5712484639cef2812a0484dcade0a3ea8ae876d110d0db4d869892df16e09ba87a1904a95a8ca90c2ca17fac29ca089e201a381c3bfe802efc1b5e7
-
SSDEEP
6144:Xtm3MTsNoPRYMv75ahdvkLDZ5C9fs2bKQIv1UjpWMC9lO2v/V:7Cs760KKQO1uC9lnXV
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2800-0-0x0000000000400000-0x00000000004B3000-memory.dmp upx behavioral2/memory/2800-2-0x0000000000400000-0x00000000004B3000-memory.dmp upx behavioral2/memory/2800-3-0x0000000000400000-0x00000000004B3000-memory.dmp upx behavioral2/memory/2800-4-0x0000000000400000-0x00000000004B3000-memory.dmp upx behavioral2/memory/2800-5-0x0000000000400000-0x00000000004B3000-memory.dmp upx behavioral2/memory/2800-6-0x0000000000400000-0x00000000004B3000-memory.dmp upx -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe File opened (read-only) \??\F: 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe Token: SeBackupPrivilege 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe 2800 07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe"C:\Users\Admin\AppData\Local\Temp\07fcc878980aa63d3049847727a5ddc5fbb73bacdf0a9b9fdeba1aaced2300a2.exe"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2800