Analysis
-
max time kernel
10s -
max time network
12s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
13-02-2024 00:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9805d77d7d7ccad537009caca3d55e37.exe
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
9805d77d7d7ccad537009caca3d55e37.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
3 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
9805d77d7d7ccad537009caca3d55e37.exe
-
Size
37KB
-
MD5
9805d77d7d7ccad537009caca3d55e37
-
SHA1
9985e365daf9ba127a606105a58f2f13df96a09b
-
SHA256
a446948d31479176e37b35b895f95cd179a04a9abf17acffadfc3f890df1db7c
-
SHA512
b82bc22a5f3ddb061785459ccb5f930fb49cabd5f7bbb7bf3a28db66c1cb72a00c92cdfa66f00f4292dc295dcc479457558631e67e2b7812f9d1f2c4636c53c3
-
SSDEEP
768:4hDoMx4O7k+9NZzHYWCw/a/UPqzJLPePHkuSHoSjh3a5gJQ:4hD9x4OgUx4T/UPqz1+rSISjhKgO
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 1972 9805d77d7d7ccad537009caca3d55e37.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9805d77d7d7ccad537009caca3d55e37.exe"C:\Users\Admin\AppData\Local\Temp\9805d77d7d7ccad537009caca3d55e37.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1972
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:1364
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵PID:2700