Overview
overview
10Static
static
3samples4.zip
windows7-x64
1samples4.zip
windows10-2004-x64
10e60d49a96...01.exe
windows7-x64
0e60d49a96...01.exe
windows10-2004-x64
1ce5dd21fb...1e.exe
windows7-x64
101ce5dd21fb...1e.exe
windows10-2004-x64
103c73425d02...e6.exe
windows7-x64
63c73425d02...e6.exe
windows10-2004-x64
65df6314b5c...5b.exe
windows7-x64
105df6314b5c...5b.exe
windows10-2004-x64
105ee5166c02...93.exe
windows7-x64
105ee5166c02...93.exe
windows10-2004-x64
105f7cdd8c28...02.exe
windows7-x64
75f7cdd8c28...02.exe
windows10-2004-x64
7Analysis
- max time kernel
140s - max time network
173s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
01/01/2024, 15:38
Static task
static1
Behavioral task
behavioral1
Sample
samples4.zip
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral2
Sample
samples4.zip
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4/0e60d49a967599fab179f8c885d91db2501.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral4
Sample
0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4/0e60d49a967599fab179f8c885d91db2501.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
1ce5dd21fbff44289d22647277a94f2611ee661cdcab323548caa0a7082ddc7d/1ce5dd21fbff44289d22647277a94f2611e.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral6
Sample
1ce5dd21fbff44289d22647277a94f2611ee661cdcab323548caa0a7082ddc7d/1ce5dd21fbff44289d22647277a94f2611e.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
3c73425d026a172779c8ffc5e338afbf6e66f1ad3020a11c2bece4658fcb28fc/3c73425d026a172779c8ffc5e338afbf6e6.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral8
Sample
3c73425d026a172779c8ffc5e338afbf6e66f1ad3020a11c2bece4658fcb28fc/3c73425d026a172779c8ffc5e338afbf6e6.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
5df6314b5c6f6bd151a5fda104d32655c5bd8153be922b80069b22f1c1de9db3/5df6314b5c6f6bd151a5fda104d32655c5b.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral10
Sample
5df6314b5c6f6bd151a5fda104d32655c5bd8153be922b80069b22f1c1de9db3/5df6314b5c6f6bd151a5fda104d32655c5b.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
5ee5166c02636f294fb8f6da69d5c0ae893a1c4694ae1bcc3753b497598121a0/5ee5166c02636f294fb8f6da69d5c0ae893.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral12
Sample
5ee5166c02636f294fb8f6da69d5c0ae893a1c4694ae1bcc3753b497598121a0/5ee5166c02636f294fb8f6da69d5c0ae893.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
5f7cdd8c28daba74fd96c1aa9de6d920b026dcea5b596e7e145ffe11c5a4cb8e/5f7cdd8c28daba74fd96c1aa9de6d920b02.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral14
Sample
5f7cdd8c28daba74fd96c1aa9de6d920b026dcea5b596e7e145ffe11c5a4cb8e/5f7cdd8c28daba74fd96c1aa9de6d920b02.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
General
- Target 3c73425d026a172779c8ffc5e338afbf6e66f1ad3020a11c2bece4658fcb28fc/3c73425d026a172779c8ffc5e338afbf6e6.exe
- Size 213KB
- Sample240101-s2944adcem
- SHA256 3c73425d026a172779c8ffc5e338afbf6e66f1ad3020a11c2bece4658fcb28fc
- MD5 045ffadc2fda21d2cd8e2fc37e9557c9
- SHA1 85fce2c0d66c852e9b7b326198da0cfb9f31fc54
- SHA512 7233efe7849edd61163d0656f1a732760f7b649f38b94cb7d8eef0e30450013d684a5b4241a1708d734c5a5ef6ce26d5cf1bdc3ccd6002d3edfc6a51e9698452
- SSDEEP 768:ZzCQUwJLKh1hn49V/KmhP1ypZr1hn49V/KmdP1ywZc:bA1hn4HmR1hn4HP+
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Drops desktop.ini file(s) 7 IoCs
description ioc Process File created C:\Users\Admin\Pictures\Camera Roll\desktop.ini 3c73425d026a172779c8ffc5e338afbf6e6.exe File created C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 3c73425d026a172779c8ffc5e338afbf6e6.exe File created C:\Users\Admin\Documents\desktop.ini 3c73425d026a172779c8ffc5e338afbf6e6.exe File created C:\Users\Admin\Music\desktop.ini 3c73425d026a172779c8ffc5e338afbf6e6.exe File created C:\Users\Admin\Videos\desktop.ini 3c73425d026a172779c8ffc5e338afbf6e6.exe File created C:\Users\Admin\Desktop\desktop.ini 3c73425d026a172779c8ffc5e338afbf6e6.exe File created C:\Users\Admin\Pictures\desktop.ini 3c73425d026a172779c8ffc5e338afbf6e6.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe 748 3c73425d026a172779c8ffc5e338afbf6e6.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 748 3c73425d026a172779c8ffc5e338afbf6e6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c73425d026a172779c8ffc5e338afbf6e66f1ad3020a11c2bece4658fcb28fc\3c73425d026a172779c8ffc5e338afbf6e6.exe"C:\Users\Admin\AppData\Local\Temp\3c73425d026a172779c8ffc5e338afbf6e66f1ad3020a11c2bece4658fcb28fc\3c73425d026a172779c8ffc5e338afbf6e6.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:748