Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
14/02/2024, 12:33
Static task
static1
Behavioral task
behavioral1
Sample
5bb2858e6948295afeaed5749401d718ca6f12760e493daea837ddaf9ba9a87f.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
5bb2858e6948295afeaed5749401d718ca6f12760e493daea837ddaf9ba9a87f.exe
Resource
win10v2004-20231222-en
General
-
Target
5bb2858e6948295afeaed5749401d718ca6f12760e493daea837ddaf9ba9a87f.exe
-
Size
767KB
-
MD5
c2503e9f6c6966ffd3d16f69c5981946
-
SHA1
f494255bf18659e7449b97e56f4e41acd5f30956
-
SHA256
5bb2858e6948295afeaed5749401d718ca6f12760e493daea837ddaf9ba9a87f
-
SHA512
63933380f87168f6374ecd63301ab3754caad29071cd6e8fdb2d041f030068bf7b25fb5f4e50f37b45928028d19f606070700acb0d3cebd774d6984b1b68122a
-
SSDEEP
12288:c7gKNkhm/JuyXnPB+h8WHNq/u9AAi4TnCf2KbCGrriUmiwFJxU72+:c7zNkhm5PBXKq/u9AAifTrri4wF6
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe 5bb2858e6948295afeaed5749401d718ca6f12760e493daea837ddaf9ba9a87f.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2268 5bb2858e6948295afeaed5749401d718ca6f12760e493daea837ddaf9ba9a87f.exe