Analysis
-
max time kernel
144s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31-12-2023 05:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
29a26edcd61d00d240cb2b7334d14131.exe
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
29a26edcd61d00d240cb2b7334d14131.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
29a26edcd61d00d240cb2b7334d14131.exe
-
Size
17.6MB
-
MD5
29a26edcd61d00d240cb2b7334d14131
-
SHA1
5aafa979424339ffbec58661f044f8d0c73aa545
-
SHA256
0e3e7f87385f74fd184798f3428482595f3065ff8919bf33beeb6e31c57a84e5
-
SHA512
363745401275eee956bde0b646c962b1a50683c817205f2e33e42f34836362518822438dcf63e2ccdb1bdbbf78be1e8505f36657da2063ef53afd301ca06511d
-
SSDEEP
393216:tg0X0FTpukcMyIRMLBTIo661372/op0+8BVy5J70gjQOTJAZ8sa:tg0XkMqPGlt372/oa+8BViJ7NjQSg
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
29a26edcd61d00d240cb2b7334d14131.exepid process 2976 29a26edcd61d00d240cb2b7334d14131.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
29a26edcd61d00d240cb2b7334d14131.exepid process 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe 2976 29a26edcd61d00d240cb2b7334d14131.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
29a26edcd61d00d240cb2b7334d14131.exedescription pid process Token: SeDebugPrivilege 2976 29a26edcd61d00d240cb2b7334d14131.exe