Analysis
-
max time kernel
146s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
11/01/2024, 20:11
Behavioral task
behavioral1
Sample
53b091bcf6bd4c9cea0b27591fc43779.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
53b091bcf6bd4c9cea0b27591fc43779.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
53b091bcf6bd4c9cea0b27591fc43779.exe
-
Size
126KB
-
MD5
53b091bcf6bd4c9cea0b27591fc43779
-
SHA1
9db7fd128d02b90cc88a2af23e83e8e83d06897e
-
SHA256
10182e3b404dbcc1c7f1c66ca7d5bcaeb9f3423606c5e7369c6fd6b002a81a2c
-
SHA512
17debdd9f93c06514703fefcc06fe831f10f68328b376507ba2a0f7360b22063eca1d2a534e2b838a3f4a99f726aaf0716ced1f7cede1843e70d64c7bdfce99b
-
SSDEEP
3072:M1UNGB+I0Oy8uIqn9X4rKttHkoIIuZkfiXqCYNg:M1UQpu8Hqx4wKodkkqXBm
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1916 svchost.exe -
Loads dropped DLL 1 IoCs
pid Process 1916 svchost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Uqrs\Aqrstuvwx.bmp 53b091bcf6bd4c9cea0b27591fc43779.exe File created C:\Program Files (x86)\Uqrs\Aqrstuvwx.bmp 53b091bcf6bd4c9cea0b27591fc43779.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 1936 53b091bcf6bd4c9cea0b27591fc43779.exe Token: SeRestorePrivilege 1936 53b091bcf6bd4c9cea0b27591fc43779.exe Token: SeBackupPrivilege 1936 53b091bcf6bd4c9cea0b27591fc43779.exe Token: SeRestorePrivilege 1936 53b091bcf6bd4c9cea0b27591fc43779.exe Token: SeBackupPrivilege 1936 53b091bcf6bd4c9cea0b27591fc43779.exe Token: SeRestorePrivilege 1936 53b091bcf6bd4c9cea0b27591fc43779.exe Token: SeBackupPrivilege 1936 53b091bcf6bd4c9cea0b27591fc43779.exe Token: SeRestorePrivilege 1936 53b091bcf6bd4c9cea0b27591fc43779.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\53b091bcf6bd4c9cea0b27591fc43779.exe"C:\Users\Admin\AppData\Local\Temp\53b091bcf6bd4c9cea0b27591fc43779.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1936
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Deletes itself
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1916