Analysis
-
max time kernel
117s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07-03-2024 01:08
Static task
static1
Behavioral task
behavioral1
Sample
6fd301a66adfcb776c00ecc765ce8e579ebc9675e7299ff5e81dbcbb2cb66bf7.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6fd301a66adfcb776c00ecc765ce8e579ebc9675e7299ff5e81dbcbb2cb66bf7.exe
Resource
win10v2004-20240226-en
General
-
Target
6fd301a66adfcb776c00ecc765ce8e579ebc9675e7299ff5e81dbcbb2cb66bf7.exe
-
Size
2.1MB
-
MD5
d2fa012fd3d2d24dd998757b38ac8230
-
SHA1
920833f9f883509dabeb80a78472f2f38e51feb1
-
SHA256
6fd301a66adfcb776c00ecc765ce8e579ebc9675e7299ff5e81dbcbb2cb66bf7
-
SHA512
f27a5d014ceeb116e4abc6eaa6850a13ca909f8d620455c2be0433157601bd49da40ad8a4afb84e0e6a13129c6c35e42e7ca47b0eb5c2de588b89fed60534af5
-
SSDEEP
49152:RkfhWdXmiSq+kqXfd+/9A+8ArSt+JE7fdvnza8so90b7aF:CEB13+kqXf0FkArS4m7BzzsU0vaF
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 1716 6fd301a66adfcb776c00ecc765ce8e579ebc9675e7299ff5e81dbcbb2cb66bf7.exe 1716 6fd301a66adfcb776c00ecc765ce8e579ebc9675e7299ff5e81dbcbb2cb66bf7.exe 1716 6fd301a66adfcb776c00ecc765ce8e579ebc9675e7299ff5e81dbcbb2cb66bf7.exe 1716 6fd301a66adfcb776c00ecc765ce8e579ebc9675e7299ff5e81dbcbb2cb66bf7.exe 1716 6fd301a66adfcb776c00ecc765ce8e579ebc9675e7299ff5e81dbcbb2cb66bf7.exe 1716 6fd301a66adfcb776c00ecc765ce8e579ebc9675e7299ff5e81dbcbb2cb66bf7.exe 1716 6fd301a66adfcb776c00ecc765ce8e579ebc9675e7299ff5e81dbcbb2cb66bf7.exe 1716 6fd301a66adfcb776c00ecc765ce8e579ebc9675e7299ff5e81dbcbb2cb66bf7.exe 1716 6fd301a66adfcb776c00ecc765ce8e579ebc9675e7299ff5e81dbcbb2cb66bf7.exe 1716 6fd301a66adfcb776c00ecc765ce8e579ebc9675e7299ff5e81dbcbb2cb66bf7.exe 1716 6fd301a66adfcb776c00ecc765ce8e579ebc9675e7299ff5e81dbcbb2cb66bf7.exe 1716 6fd301a66adfcb776c00ecc765ce8e579ebc9675e7299ff5e81dbcbb2cb66bf7.exe 1716 6fd301a66adfcb776c00ecc765ce8e579ebc9675e7299ff5e81dbcbb2cb66bf7.exe 1716 6fd301a66adfcb776c00ecc765ce8e579ebc9675e7299ff5e81dbcbb2cb66bf7.exe 1716 6fd301a66adfcb776c00ecc765ce8e579ebc9675e7299ff5e81dbcbb2cb66bf7.exe 1716 6fd301a66adfcb776c00ecc765ce8e579ebc9675e7299ff5e81dbcbb2cb66bf7.exe 1716 6fd301a66adfcb776c00ecc765ce8e579ebc9675e7299ff5e81dbcbb2cb66bf7.exe 1716 6fd301a66adfcb776c00ecc765ce8e579ebc9675e7299ff5e81dbcbb2cb66bf7.exe 1716 6fd301a66adfcb776c00ecc765ce8e579ebc9675e7299ff5e81dbcbb2cb66bf7.exe 1716 6fd301a66adfcb776c00ecc765ce8e579ebc9675e7299ff5e81dbcbb2cb66bf7.exe 1716 6fd301a66adfcb776c00ecc765ce8e579ebc9675e7299ff5e81dbcbb2cb66bf7.exe 1716 6fd301a66adfcb776c00ecc765ce8e579ebc9675e7299ff5e81dbcbb2cb66bf7.exe 1716 6fd301a66adfcb776c00ecc765ce8e579ebc9675e7299ff5e81dbcbb2cb66bf7.exe 1716 6fd301a66adfcb776c00ecc765ce8e579ebc9675e7299ff5e81dbcbb2cb66bf7.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1716 6fd301a66adfcb776c00ecc765ce8e579ebc9675e7299ff5e81dbcbb2cb66bf7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6fd301a66adfcb776c00ecc765ce8e579ebc9675e7299ff5e81dbcbb2cb66bf7.exe"C:\Users\Admin\AppData\Local\Temp\6fd301a66adfcb776c00ecc765ce8e579ebc9675e7299ff5e81dbcbb2cb66bf7.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1716