Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12/01/2024, 02:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
55486a073e3735536940866ad18ed018.exe
Resource
win7-20231129-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
55486a073e3735536940866ad18ed018.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
55486a073e3735536940866ad18ed018.exe
-
Size
34KB
-
MD5
55486a073e3735536940866ad18ed018
-
SHA1
01701aea22201da7dc7f2a63653903a27c960fe2
-
SHA256
cdd8b8f23dca64836aa8230e90e940711bc13b8545ff0d1436cdfe449cdafc63
-
SHA512
780f9e41b97ec773f93787a113dd939d532935316d315fa8b75e8762facc3ab1310e9c7c959d6a8041dedcb79d06c9aabe534403454ed4d59413386ef12288ab
-
SSDEEP
768:ZE89oJkP/FCiMyjuFLiacrIDXpJLO/87+hdyfdJ:6n6xupcrIDXp9OQ+if
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Bifrost\server.exe 55486a073e3735536940866ad18ed018.exe File created C:\Windows\SysWOW64\Bifrost\server.exe 55486a073e3735536940866ad18ed018.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2292 55486a073e3735536940866ad18ed018.exe Token: SeDebugPrivilege 2292 55486a073e3735536940866ad18ed018.exe