Analysis
-
max time kernel
162s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
10/01/2024, 05:09
Behavioral task
behavioral1
Sample
4faadc0dd68145543866339526413a77.exe
Resource
win7-20231215-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
4faadc0dd68145543866339526413a77.exe
Resource
win10v2004-20231215-en
3 signatures
150 seconds
General
-
Target
4faadc0dd68145543866339526413a77.exe
-
Size
569KB
-
MD5
4faadc0dd68145543866339526413a77
-
SHA1
f1b40c15ecfc16547205d207bfc9b248f415b3ab
-
SHA256
81d26389e5236cbb8b9991cd92547272318ded4ca09eee56cbf93203e4dd3f20
-
SHA512
d8a0ab616fdb9fbdaa10c481d81d00712b5ca433e9a4ab3f612d101a9f79b320a32da9cf24090b11e6acd22815b39ddd76dc3a37234662c5789a4fabd4472c08
-
SSDEEP
12288:dV2zNBYDs3zyS7kSBhnaUx6RrsMEcrVt8nTZ6bjXUZZvG0Ub60q:GzNBKsDdznj6NsjcrVWngHUZZsO
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\dtkrnl32.dll 4faadc0dd68145543866339526413a77.exe File created C:\Windows\SysWOW64\wpabkp.log 4faadc0dd68145543866339526413a77.exe File opened for modification C:\Windows\SysWOW64\wpabkp.log 4faadc0dd68145543866339526413a77.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 972 4faadc0dd68145543866339526413a77.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 972 4faadc0dd68145543866339526413a77.exe 972 4faadc0dd68145543866339526413a77.exe