Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26-02-2024 21:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
021b477ace5e87113272fd8b16830051.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
021b477ace5e87113272fd8b16830051.exe
Resource
win10v2004-20240226-en
9 signatures
150 seconds
General
-
Target
021b477ace5e87113272fd8b16830051.exe
-
Size
184KB
-
MD5
021b477ace5e87113272fd8b16830051
-
SHA1
d55ddb61b67e53245adc5bd12822ea56f1602820
-
SHA256
e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd
-
SHA512
ef8c8ff1ff3326848becef2615bd2a629dd1eced13c9b9776d75f3a5cfd2e913324422f806264126befdd0d6908d16be081218ab61fe20ef95111cf9a41c8817
-
SSDEEP
3072:qUZiBJUB7JXbbkiTIR4JQffGaJNnN7SD+631zmh6Ty1:hiBWBdbkiTIR4ufGaJNnN7SC631zmh6+
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2868 set thread context of 1708 2868 021b477ace5e87113272fd8b16830051.exe 28 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2868 021b477ace5e87113272fd8b16830051.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2868 wrote to memory of 1708 2868 021b477ace5e87113272fd8b16830051.exe 28 PID 2868 wrote to memory of 1708 2868 021b477ace5e87113272fd8b16830051.exe 28 PID 2868 wrote to memory of 1708 2868 021b477ace5e87113272fd8b16830051.exe 28 PID 2868 wrote to memory of 1708 2868 021b477ace5e87113272fd8b16830051.exe 28 PID 2868 wrote to memory of 1708 2868 021b477ace5e87113272fd8b16830051.exe 28 PID 2868 wrote to memory of 1708 2868 021b477ace5e87113272fd8b16830051.exe 28 PID 2868 wrote to memory of 1708 2868 021b477ace5e87113272fd8b16830051.exe 28 PID 2868 wrote to memory of 1708 2868 021b477ace5e87113272fd8b16830051.exe 28 PID 2868 wrote to memory of 1708 2868 021b477ace5e87113272fd8b16830051.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\021b477ace5e87113272fd8b16830051.exe"C:\Users\Admin\AppData\Local\Temp\021b477ace5e87113272fd8b16830051.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\021b477ace5e87113272fd8b16830051.exeC:\Users\Admin\AppData\Local\Temp\021b477ace5e87113272fd8b16830051.exe2⤵PID:1708
-