Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22/01/2024, 20:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bTfk.exe
Resource
win7-20231215-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
bTfk.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
bTfk.exe
-
Size
36KB
-
MD5
75e7abbc617cf3dbcb68b2bd43d03115
-
SHA1
182af2e118f11a3a50bc3eec4deb70b22e4faed7
-
SHA256
77467ced122704b311807b5da3c575217a903e2434bf04c47c0ebf00c19ae474
-
SHA512
be174023d37f4229cf4474bfe638686e5c3165d0e7f17bea1b0e9d8860a006640e82667ea6066aa24d5fa4b3b3ffdc70256f804c5abf8ed1d23efff1d22acc13
-
SSDEEP
384:CLd2LzreBCAuKiEZePC45SY2OzRLTm3yilqr6LUbOyvGj:cizrecPEZeK45SssIvGj
Score
10/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Server.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\bTfk.exe\"" bTfk.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 376 bTfk.exe Token: 33 376 bTfk.exe Token: SeIncBasePriorityPrivilege 376 bTfk.exe Token: 33 376 bTfk.exe Token: SeIncBasePriorityPrivilege 376 bTfk.exe Token: 33 376 bTfk.exe Token: SeIncBasePriorityPrivilege 376 bTfk.exe Token: 33 376 bTfk.exe Token: SeIncBasePriorityPrivilege 376 bTfk.exe Token: 33 376 bTfk.exe Token: SeIncBasePriorityPrivilege 376 bTfk.exe Token: 33 376 bTfk.exe Token: SeIncBasePriorityPrivilege 376 bTfk.exe Token: 33 376 bTfk.exe Token: SeIncBasePriorityPrivilege 376 bTfk.exe Token: 33 376 bTfk.exe Token: SeIncBasePriorityPrivilege 376 bTfk.exe Token: 33 376 bTfk.exe Token: SeIncBasePriorityPrivilege 376 bTfk.exe Token: 33 376 bTfk.exe Token: SeIncBasePriorityPrivilege 376 bTfk.exe Token: 33 376 bTfk.exe Token: SeIncBasePriorityPrivilege 376 bTfk.exe Token: 33 376 bTfk.exe Token: SeIncBasePriorityPrivilege 376 bTfk.exe Token: 33 376 bTfk.exe Token: SeIncBasePriorityPrivilege 376 bTfk.exe Token: 33 376 bTfk.exe Token: SeIncBasePriorityPrivilege 376 bTfk.exe Token: 33 376 bTfk.exe Token: SeIncBasePriorityPrivilege 376 bTfk.exe Token: 33 376 bTfk.exe Token: SeIncBasePriorityPrivilege 376 bTfk.exe Token: 33 376 bTfk.exe Token: SeIncBasePriorityPrivilege 376 bTfk.exe Token: 33 376 bTfk.exe Token: SeIncBasePriorityPrivilege 376 bTfk.exe Token: 33 376 bTfk.exe Token: SeIncBasePriorityPrivilege 376 bTfk.exe Token: 33 376 bTfk.exe Token: SeIncBasePriorityPrivilege 376 bTfk.exe Token: 33 376 bTfk.exe Token: SeIncBasePriorityPrivilege 376 bTfk.exe Token: 33 376 bTfk.exe Token: SeIncBasePriorityPrivilege 376 bTfk.exe Token: 33 376 bTfk.exe Token: SeIncBasePriorityPrivilege 376 bTfk.exe Token: 33 376 bTfk.exe Token: SeIncBasePriorityPrivilege 376 bTfk.exe Token: 33 376 bTfk.exe Token: SeIncBasePriorityPrivilege 376 bTfk.exe Token: 33 376 bTfk.exe Token: SeIncBasePriorityPrivilege 376 bTfk.exe Token: 33 376 bTfk.exe Token: SeIncBasePriorityPrivilege 376 bTfk.exe Token: 33 376 bTfk.exe Token: SeIncBasePriorityPrivilege 376 bTfk.exe Token: 33 376 bTfk.exe Token: SeIncBasePriorityPrivilege 376 bTfk.exe Token: 33 376 bTfk.exe Token: SeIncBasePriorityPrivilege 376 bTfk.exe Token: 33 376 bTfk.exe Token: SeIncBasePriorityPrivilege 376 bTfk.exe Token: 33 376 bTfk.exe