Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
12-02-2024 01:57
Behavioral task
behavioral1
Sample
86a385af82154816c819180b7501f5c614f442482957599b56a7932eb6691135.exe
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
86a385af82154816c819180b7501f5c614f442482957599b56a7932eb6691135.exe
Resource
win10v2004-20231222-en
2 signatures
150 seconds
General
-
Target
86a385af82154816c819180b7501f5c614f442482957599b56a7932eb6691135.exe
-
Size
32KB
-
MD5
400f00d600f464e055cbcd68982d05c3
-
SHA1
9186b9436ddb37d3d082564b8875274109c98ea9
-
SHA256
86a385af82154816c819180b7501f5c614f442482957599b56a7932eb6691135
-
SHA512
a1b3d1257286b6a7f3c0bccde32dd3680da3882e00e1a054da7f8abab92ebf7cb31f6527e888f045e2f30d40852cda0c4ee40d035ece16b5f1d53369618f850c
-
SSDEEP
384:a0bUe5XB4e0XWOnjHdqlzkB8N/nWTGtTUFQqzFFObb3m:DT9BuFrdKNLb2
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
86a385af82154816c819180b7501f5c614f442482957599b56a7932eb6691135.exedescription pid process Token: SeDebugPrivilege 2184 86a385af82154816c819180b7501f5c614f442482957599b56a7932eb6691135.exe Token: 33 2184 86a385af82154816c819180b7501f5c614f442482957599b56a7932eb6691135.exe Token: SeIncBasePriorityPrivilege 2184 86a385af82154816c819180b7501f5c614f442482957599b56a7932eb6691135.exe Token: 33 2184 86a385af82154816c819180b7501f5c614f442482957599b56a7932eb6691135.exe Token: SeIncBasePriorityPrivilege 2184 86a385af82154816c819180b7501f5c614f442482957599b56a7932eb6691135.exe Token: 33 2184 86a385af82154816c819180b7501f5c614f442482957599b56a7932eb6691135.exe Token: SeIncBasePriorityPrivilege 2184 86a385af82154816c819180b7501f5c614f442482957599b56a7932eb6691135.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
86a385af82154816c819180b7501f5c614f442482957599b56a7932eb6691135.exedescription pid process target process PID 2184 wrote to memory of 2952 2184 86a385af82154816c819180b7501f5c614f442482957599b56a7932eb6691135.exe cmd.exe PID 2184 wrote to memory of 2952 2184 86a385af82154816c819180b7501f5c614f442482957599b56a7932eb6691135.exe cmd.exe PID 2184 wrote to memory of 2952 2184 86a385af82154816c819180b7501f5c614f442482957599b56a7932eb6691135.exe cmd.exe PID 2184 wrote to memory of 2952 2184 86a385af82154816c819180b7501f5c614f442482957599b56a7932eb6691135.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\86a385af82154816c819180b7501f5c614f442482957599b56a7932eb6691135.exe"C:\Users\Admin\AppData\Local\Temp\86a385af82154816c819180b7501f5c614f442482957599b56a7932eb6691135.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\cmd.execmd.exe /C Y /N /D Y /T 1 & Del "C:\Users\Admin\AppData\Local\Temp\86a385af82154816c819180b7501f5c614f442482957599b56a7932eb6691135.exe"2⤵PID:2952