Analysis
- max time kernel
161s - max time network
164s - platform
windows10-2004_x64 - resource
win10v2004-20240221-en - resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system - submitted
25/02/2024, 12:43
Behavioral task
behavioral1
Sample
a3d068ec910eafbe3412273717fa92c2.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
General
- Target a3d068ec910eafbe3412273717fa92c2.exe
- Size 248KB
- Sample240225-pyb64scf2t
- SHA256 9ac041596af48fa236a854c75cad81b564f64f52dec81e8f7611b22924d38e35
- MD5 a3d068ec910eafbe3412273717fa92c2
- SHA1 19332c8652279d0d65c855971fe60119700aff5e
- SHA512 a3a92cc4b0934fabd94a10875f2857085fc886122be377aa3b7eb4b2882bffdd22741c0b239cd9a3394e97f420e16d663d5de67a5f36559a4ba1591eb0d12682
- SSDEEP 6144:cMBv0PANBsg5gMtUEM+Qhz1l6MXR6AL+r:LB82lVUF3h
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1116 set thread context of 4224 1116 a3d068ec910eafbe3412273717fa92c2.exe 92 - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1116 a3d068ec910eafbe3412273717fa92c2.exe Token: SeSecurityPrivilege 1116 a3d068ec910eafbe3412273717fa92c2.exe Token: SeTakeOwnershipPrivilege 1116 a3d068ec910eafbe3412273717fa92c2.exe Token: SeLoadDriverPrivilege 1116 a3d068ec910eafbe3412273717fa92c2.exe Token: SeSystemProfilePrivilege 1116 a3d068ec910eafbe3412273717fa92c2.exe Token: SeSystemtimePrivilege 1116 a3d068ec910eafbe3412273717fa92c2.exe Token: SeProfSingleProcessPrivilege 1116 a3d068ec910eafbe3412273717fa92c2.exe Token: SeIncBasePriorityPrivilege 1116 a3d068ec910eafbe3412273717fa92c2.exe Token: SeCreatePagefilePrivilege 1116 a3d068ec910eafbe3412273717fa92c2.exe Token: SeBackupPrivilege 1116 a3d068ec910eafbe3412273717fa92c2.exe Token: SeRestorePrivilege 1116 a3d068ec910eafbe3412273717fa92c2.exe Token: SeShutdownPrivilege 1116 a3d068ec910eafbe3412273717fa92c2.exe Token: SeDebugPrivilege 1116 a3d068ec910eafbe3412273717fa92c2.exe Token: SeSystemEnvironmentPrivilege 1116 a3d068ec910eafbe3412273717fa92c2.exe Token: SeChangeNotifyPrivilege 1116 a3d068ec910eafbe3412273717fa92c2.exe Token: SeRemoteShutdownPrivilege 1116 a3d068ec910eafbe3412273717fa92c2.exe Token: SeUndockPrivilege 1116 a3d068ec910eafbe3412273717fa92c2.exe Token: SeManageVolumePrivilege 1116 a3d068ec910eafbe3412273717fa92c2.exe Token: SeImpersonatePrivilege 1116 a3d068ec910eafbe3412273717fa92c2.exe Token: SeCreateGlobalPrivilege 1116 a3d068ec910eafbe3412273717fa92c2.exe Token: 33 1116 a3d068ec910eafbe3412273717fa92c2.exe Token: 34 1116 a3d068ec910eafbe3412273717fa92c2.exe Token: 35 1116 a3d068ec910eafbe3412273717fa92c2.exe Token: 36 1116 a3d068ec910eafbe3412273717fa92c2.exe Token: SeIncreaseQuotaPrivilege 4224 iexplore.exe Token: SeSecurityPrivilege 4224 iexplore.exe Token: SeTakeOwnershipPrivilege 4224 iexplore.exe Token: SeLoadDriverPrivilege 4224 iexplore.exe Token: SeSystemProfilePrivilege 4224 iexplore.exe Token: SeSystemtimePrivilege 4224 iexplore.exe Token: SeProfSingleProcessPrivilege 4224 iexplore.exe Token: SeIncBasePriorityPrivilege 4224 iexplore.exe Token: SeCreatePagefilePrivilege 4224 iexplore.exe Token: SeBackupPrivilege 4224 iexplore.exe Token: SeRestorePrivilege 4224 iexplore.exe Token: SeShutdownPrivilege 4224 iexplore.exe Token: SeDebugPrivilege 4224 iexplore.exe Token: SeSystemEnvironmentPrivilege 4224 iexplore.exe Token: SeChangeNotifyPrivilege 4224 iexplore.exe Token: SeRemoteShutdownPrivilege 4224 iexplore.exe Token: SeUndockPrivilege 4224 iexplore.exe Token: SeManageVolumePrivilege 4224 iexplore.exe Token: SeImpersonatePrivilege 4224 iexplore.exe Token: SeCreateGlobalPrivilege 4224 iexplore.exe Token: 33 4224 iexplore.exe Token: 34 4224 iexplore.exe Token: 35 4224 iexplore.exe Token: 36 4224 iexplore.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1116 wrote to memory of 4224 1116 a3d068ec910eafbe3412273717fa92c2.exe 92 PID 1116 wrote to memory of 4224 1116 a3d068ec910eafbe3412273717fa92c2.exe 92 PID 1116 wrote to memory of 4224 1116 a3d068ec910eafbe3412273717fa92c2.exe 92 PID 1116 wrote to memory of 4224 1116 a3d068ec910eafbe3412273717fa92c2.exe 92 PID 1116 wrote to memory of 4224 1116 a3d068ec910eafbe3412273717fa92c2.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3d068ec910eafbe3412273717fa92c2.exe"C:\Users\Admin\AppData\Local\Temp\a3d068ec910eafbe3412273717fa92c2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4224
-