Analysis
-
max time kernel
1s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
03-01-2024 11:53
Static task
static1
Behavioral task
behavioral1
Sample
a33c5d499d3619b23cb9fa7c227e9aad40ef82833cbaac280e9a5197b4b7d33e.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
a33c5d499d3619b23cb9fa7c227e9aad40ef82833cbaac280e9a5197b4b7d33e.exe
Resource
win10v2004-20231222-en
General
-
Target
a33c5d499d3619b23cb9fa7c227e9aad40ef82833cbaac280e9a5197b4b7d33e.exe
-
Size
3.4MB
-
MD5
7046c38dac67b20912230c63c35764db
-
SHA1
ed5bafa2be7e3550d358068bc66984095da5d86e
-
SHA256
a33c5d499d3619b23cb9fa7c227e9aad40ef82833cbaac280e9a5197b4b7d33e
-
SHA512
da182fbefa2d149015171173b7024591cf1287b9bae402c1e242ce45d93e71e5274a77832bda2c230765163745e48f297d63cffe899834ebfaaff5790c5d8921
-
SSDEEP
98304:N0s0h9jIp6FYskEhi6jESyfbfhW1ZeaxC7a1:2E6+skCAfD8WaxC7a1
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1696 a33c5d499d3619b23cb9fa7c227e9aad40ef82833cbaac280e9a5197b4b7d33e.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1696 a33c5d499d3619b23cb9fa7c227e9aad40ef82833cbaac280e9a5197b4b7d33e.exe 1696 a33c5d499d3619b23cb9fa7c227e9aad40ef82833cbaac280e9a5197b4b7d33e.exe 1696 a33c5d499d3619b23cb9fa7c227e9aad40ef82833cbaac280e9a5197b4b7d33e.exe 1696 a33c5d499d3619b23cb9fa7c227e9aad40ef82833cbaac280e9a5197b4b7d33e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a33c5d499d3619b23cb9fa7c227e9aad40ef82833cbaac280e9a5197b4b7d33e.exe"C:\Users\Admin\AppData\Local\Temp\a33c5d499d3619b23cb9fa7c227e9aad40ef82833cbaac280e9a5197b4b7d33e.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1696