Analysis
-
max time kernel
158s -
max time network
167s -
platform
windows10-1703_x64 -
resource
win10-20231215-en -
resource tags
arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system -
submitted
06/01/2024, 21:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
W-Inject.exe
Resource
win10-20231215-en
windows10-1703-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
W-Inject.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
W-Inject.exe
-
Size
190KB
-
MD5
13652bccac626a55d5a7a98a5f05caa3
-
SHA1
a8ed168be1254d8b29ceb0ad6bc32aeb235a144a
-
SHA256
d57f8d6e48cd20ccd6c4f4d638e3ca7cd5e364889704be5b2c23b56d41a81948
-
SHA512
4ba9d393e5518aecf3d5d8870fce110753911790b1b2e298f8a22f1d8daeefc628f1866593fef36ad669197a263fd932b1163a934123a1f04f83c3b569afb1ac
-
SSDEEP
3072:letG2AJ1Z4dnoBLfeHYOXdpy2c+WCY+fxrmjd0XAUsHsHWifQb:leGb1Z4JoBLfe5XdDWCYLhbAQ
Score
6/10
Malware Config
Signatures
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini W-Inject.exe File opened for modification C:\Windows\assembly\Desktop.ini W-Inject.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\assembly W-Inject.exe File created C:\Windows\assembly\Desktop.ini W-Inject.exe File opened for modification C:\Windows\assembly\Desktop.ini W-Inject.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5012 W-Inject.exe Token: 33 5012 W-Inject.exe Token: SeIncBasePriorityPrivilege 5012 W-Inject.exe Token: 33 5012 W-Inject.exe Token: SeIncBasePriorityPrivilege 5012 W-Inject.exe Token: 33 5012 W-Inject.exe Token: SeIncBasePriorityPrivilege 5012 W-Inject.exe Token: 33 5012 W-Inject.exe Token: SeIncBasePriorityPrivilege 5012 W-Inject.exe Token: 33 5012 W-Inject.exe Token: SeIncBasePriorityPrivilege 5012 W-Inject.exe Token: 33 5012 W-Inject.exe Token: SeIncBasePriorityPrivilege 5012 W-Inject.exe Token: 33 5012 W-Inject.exe Token: SeIncBasePriorityPrivilege 5012 W-Inject.exe Token: 33 5012 W-Inject.exe Token: SeIncBasePriorityPrivilege 5012 W-Inject.exe Token: 33 5012 W-Inject.exe Token: SeIncBasePriorityPrivilege 5012 W-Inject.exe Token: 33 5012 W-Inject.exe Token: SeIncBasePriorityPrivilege 5012 W-Inject.exe Token: 33 5012 W-Inject.exe Token: SeIncBasePriorityPrivilege 5012 W-Inject.exe Token: 33 5012 W-Inject.exe Token: SeIncBasePriorityPrivilege 5012 W-Inject.exe Token: 33 5012 W-Inject.exe Token: SeIncBasePriorityPrivilege 5012 W-Inject.exe Token: 33 5012 W-Inject.exe Token: SeIncBasePriorityPrivilege 5012 W-Inject.exe Token: 33 5012 W-Inject.exe Token: SeIncBasePriorityPrivilege 5012 W-Inject.exe Token: 33 5012 W-Inject.exe Token: SeIncBasePriorityPrivilege 5012 W-Inject.exe Token: 33 5012 W-Inject.exe Token: SeIncBasePriorityPrivilege 5012 W-Inject.exe Token: 33 5012 W-Inject.exe Token: SeIncBasePriorityPrivilege 5012 W-Inject.exe Token: 33 5012 W-Inject.exe Token: SeIncBasePriorityPrivilege 5012 W-Inject.exe Token: 33 5012 W-Inject.exe Token: SeIncBasePriorityPrivilege 5012 W-Inject.exe Token: 33 5012 W-Inject.exe Token: SeIncBasePriorityPrivilege 5012 W-Inject.exe Token: 33 5012 W-Inject.exe Token: SeIncBasePriorityPrivilege 5012 W-Inject.exe Token: 33 5012 W-Inject.exe Token: SeIncBasePriorityPrivilege 5012 W-Inject.exe Token: 33 5012 W-Inject.exe Token: SeIncBasePriorityPrivilege 5012 W-Inject.exe Token: 33 5012 W-Inject.exe Token: SeIncBasePriorityPrivilege 5012 W-Inject.exe Token: 33 5012 W-Inject.exe Token: SeIncBasePriorityPrivilege 5012 W-Inject.exe Token: 33 5012 W-Inject.exe Token: SeIncBasePriorityPrivilege 5012 W-Inject.exe Token: 33 5012 W-Inject.exe Token: SeIncBasePriorityPrivilege 5012 W-Inject.exe Token: 33 5012 W-Inject.exe Token: SeIncBasePriorityPrivilege 5012 W-Inject.exe Token: 33 5012 W-Inject.exe Token: SeIncBasePriorityPrivilege 5012 W-Inject.exe Token: 33 5012 W-Inject.exe Token: SeIncBasePriorityPrivilege 5012 W-Inject.exe Token: 33 5012 W-Inject.exe