Analysis
-
max time kernel
117s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
24/02/2024, 07:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a1401f8d454d1b16f4bf36ec5801bb2b.exe
Resource
win7-20240215-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
a1401f8d454d1b16f4bf36ec5801bb2b.exe
Resource
win10v2004-20240221-en
4 signatures
150 seconds
General
-
Target
a1401f8d454d1b16f4bf36ec5801bb2b.exe
-
Size
36KB
-
MD5
a1401f8d454d1b16f4bf36ec5801bb2b
-
SHA1
76f365655bd07a231fe83d86795e3c12718b93ec
-
SHA256
7154e23ec512252605c1134924a83ca78a07d41771df01bfd84eca9dee3cd7b4
-
SHA512
ad63dc5b030c81a10f907a44dae46bea1ec54d950a54d5870efeee8e59250ac98303aaada68e487a479b6bb78ed6fa9bb1fcb74444e0a83a539c399d8234ad5a
-
SSDEEP
768:A/U6AycM5sXXVnHLp2TKJHO+qsmDFn4gp5SlOwt5pAuM:k1MpjJHO+qsmD+I5SJt5pAuM
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\systemInfomations.ini a1401f8d454d1b16f4bf36ec5801bb2b.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2312 a1401f8d454d1b16f4bf36ec5801bb2b.exe 2312 a1401f8d454d1b16f4bf36ec5801bb2b.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 480 Process not Found -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2312 a1401f8d454d1b16f4bf36ec5801bb2b.exe Token: SeSystemtimePrivilege 2312 a1401f8d454d1b16f4bf36ec5801bb2b.exe