Analysis
-
max time kernel
171s -
max time network
196s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19/01/2024, 01:01
Static task
static1
Behavioral task
behavioral1
Sample
4ee9ecf9c52b7077900ff2c7f8967f137935be21601cc4b4fba700b11f420cb3.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4ee9ecf9c52b7077900ff2c7f8967f137935be21601cc4b4fba700b11f420cb3.exe
Resource
win10v2004-20231215-en
General
-
Target
4ee9ecf9c52b7077900ff2c7f8967f137935be21601cc4b4fba700b11f420cb3.exe
-
Size
743KB
-
MD5
0e9365d2d09e90105be80bf19ce6910d
-
SHA1
4591dc2b7c9d003329e14ca71038a43ec09db61f
-
SHA256
4ee9ecf9c52b7077900ff2c7f8967f137935be21601cc4b4fba700b11f420cb3
-
SHA512
f5f982d0af11ecee4e455198d1f9dc08f65f8cdfbeda588f1b10be9e26877a29d456877ea203a79b4983c08383f453df6842d92e757c38b3e1fccb3effaca0d9
-
SSDEEP
12288:Jo+J6Sv2iNhJz/IIHF3fKqH36glTOr3G81RBwp3r1cWl6M80az3JQMd0y0/IEg0N:JoxSv1HJz/IIHFv9HZ239SbB6M8rsQFa
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 4388 4ee9ecf9c52b7077900ff2c7f8967f137935be21601cc4b4fba700b11f420cb3.exe 4388 4ee9ecf9c52b7077900ff2c7f8967f137935be21601cc4b4fba700b11f420cb3.exe 4388 4ee9ecf9c52b7077900ff2c7f8967f137935be21601cc4b4fba700b11f420cb3.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4388 4ee9ecf9c52b7077900ff2c7f8967f137935be21601cc4b4fba700b11f420cb3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ee9ecf9c52b7077900ff2c7f8967f137935be21601cc4b4fba700b11f420cb3.exe"C:\Users\Admin\AppData\Local\Temp\4ee9ecf9c52b7077900ff2c7f8967f137935be21601cc4b4fba700b11f420cb3.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4388