adced62cc3699104fccf02298ae0743e49f11c51bbd6ebea524a785ec82cb5a1 | Triage

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-02-2024 15:42

Sharing

Report Analysis Logs

General

Target

ac3e25e9f7caf0de7997d66b4e746e84.exe
Size

3.8MB
MD5

ac3e25e9f7caf0de7997d66b4e746e84
SHA1

b5a4abcb51121714de299ae59696b5bcf3c5f969
SHA256

adced62cc3699104fccf02298ae0743e49f11c51bbd6ebea524a785ec82cb5a1
SHA512

e00e1a393d5e1845295c1d8c29626375892b282ae902df0f98e8133c7b025028e20eeed34e7deb15ef3ca18f5bdfe7c33989cc784103049faa2a6ac7d2156f2f
SSDEEP

98304:877Pmq33rE/JDLPWZADUGer7B6iY74M/jmlwXVZaFB:K+R/eZADUXR

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

ac3e25e9f7caf0de7997d66b4e746e84.exe

pid	process
2360	ac3e25e9f7caf0de7997d66b4e746e84.exe
2360	ac3e25e9f7caf0de7997d66b4e746e84.exe
2360	ac3e25e9f7caf0de7997d66b4e746e84.exe
2360	ac3e25e9f7caf0de7997d66b4e746e84.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

ac3e25e9f7caf0de7997d66b4e746e84.exe

description	pid	process
Token: SeDebugPrivilege	2360	ac3e25e9f7caf0de7997d66b4e746e84.exe
Token: SeShutdownPrivilege	2360	ac3e25e9f7caf0de7997d66b4e746e84.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

ac3e25e9f7caf0de7997d66b4e746e84.exe

pid process

2360 ac3e25e9f7caf0de7997d66b4e746e84.exe
2360 ac3e25e9f7caf0de7997d66b4e746e84.exe

C:\Users\Admin\AppData\Local\Temp\ac3e25e9f7caf0de7997d66b4e746e84.exe
"C:\Users\Admin\AppData\Local\Temp\ac3e25e9f7caf0de7997d66b4e746e84.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...