Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24-01-2024 09:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
71ecb6b43a570d7d31ac1a467cdbfddf.exe
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
71ecb6b43a570d7d31ac1a467cdbfddf.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
71ecb6b43a570d7d31ac1a467cdbfddf.exe
-
Size
36KB
-
MD5
71ecb6b43a570d7d31ac1a467cdbfddf
-
SHA1
02fe5e091dec660dafd1cf21f88a431dedc796f8
-
SHA256
dcf884c29521dcb5683b6897d86c7488016df98738f99268bcae9f5fa3a20b3e
-
SHA512
76ab61429e05627f398aeebaaa9d94a76b38b73360ad7aac86a37780dc91a5e26e414416dd207a397a8156c9d04f7ec186bc699727aa3bc09cc30f728896fec0
-
SSDEEP
384:AX8BR9cTZ4i+dIntf/scNaReg7RNC596wrEWzlaX8u8w1P:AX8ZcTc+tf/sckRegynjEWNw1P
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 3060 71ecb6b43a570d7d31ac1a467cdbfddf.exe -
Suspicious use of AdjustPrivilegeToken 27 IoCs
description pid Process Token: SeCreateTokenPrivilege 3060 71ecb6b43a570d7d31ac1a467cdbfddf.exe Token: SeAssignPrimaryTokenPrivilege 3060 71ecb6b43a570d7d31ac1a467cdbfddf.exe Token: SeLockMemoryPrivilege 3060 71ecb6b43a570d7d31ac1a467cdbfddf.exe Token: SeIncreaseQuotaPrivilege 3060 71ecb6b43a570d7d31ac1a467cdbfddf.exe Token: SeMachineAccountPrivilege 3060 71ecb6b43a570d7d31ac1a467cdbfddf.exe Token: SeTcbPrivilege 3060 71ecb6b43a570d7d31ac1a467cdbfddf.exe Token: SeSecurityPrivilege 3060 71ecb6b43a570d7d31ac1a467cdbfddf.exe Token: SeTakeOwnershipPrivilege 3060 71ecb6b43a570d7d31ac1a467cdbfddf.exe Token: SeLoadDriverPrivilege 3060 71ecb6b43a570d7d31ac1a467cdbfddf.exe Token: SeSystemProfilePrivilege 3060 71ecb6b43a570d7d31ac1a467cdbfddf.exe Token: SeSystemtimePrivilege 3060 71ecb6b43a570d7d31ac1a467cdbfddf.exe Token: SeProfSingleProcessPrivilege 3060 71ecb6b43a570d7d31ac1a467cdbfddf.exe Token: SeIncBasePriorityPrivilege 3060 71ecb6b43a570d7d31ac1a467cdbfddf.exe Token: SeCreatePagefilePrivilege 3060 71ecb6b43a570d7d31ac1a467cdbfddf.exe Token: SeCreatePermanentPrivilege 3060 71ecb6b43a570d7d31ac1a467cdbfddf.exe Token: SeBackupPrivilege 3060 71ecb6b43a570d7d31ac1a467cdbfddf.exe Token: SeRestorePrivilege 3060 71ecb6b43a570d7d31ac1a467cdbfddf.exe Token: SeShutdownPrivilege 3060 71ecb6b43a570d7d31ac1a467cdbfddf.exe Token: SeDebugPrivilege 3060 71ecb6b43a570d7d31ac1a467cdbfddf.exe Token: SeAuditPrivilege 3060 71ecb6b43a570d7d31ac1a467cdbfddf.exe Token: SeSystemEnvironmentPrivilege 3060 71ecb6b43a570d7d31ac1a467cdbfddf.exe Token: SeChangeNotifyPrivilege 3060 71ecb6b43a570d7d31ac1a467cdbfddf.exe Token: SeRemoteShutdownPrivilege 3060 71ecb6b43a570d7d31ac1a467cdbfddf.exe Token: SeUndockPrivilege 3060 71ecb6b43a570d7d31ac1a467cdbfddf.exe Token: SeSyncAgentPrivilege 3060 71ecb6b43a570d7d31ac1a467cdbfddf.exe Token: SeEnableDelegationPrivilege 3060 71ecb6b43a570d7d31ac1a467cdbfddf.exe Token: SeManageVolumePrivilege 3060 71ecb6b43a570d7d31ac1a467cdbfddf.exe