36ed94fb9f8ef3f5cbf8494ff6400d0be353ae7c223ed209bd85d466d1ba1ff7

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12-03-2024 02:24

Target

36ed94fb9f8ef3f5cbf8494ff6400d0be353ae7c223ed209bd85d466d1ba1ff7.exe
Size

8KB
MD5

dc0d40579447b035d980cf0b8cd7667c
SHA1

c907f983cb27d5caec6c941e0712afcc973487d0
SHA256

36ed94fb9f8ef3f5cbf8494ff6400d0be353ae7c223ed209bd85d466d1ba1ff7
SHA512

ed37522b52b617877b5e5f7023a0138baf396c0b33393d6155dbb6bfa4b3347b737e5493cbde634fa1937d0094a7b9b543929e6f32b35331a8c6dc838f38d51b
SSDEEP

96:5g48vbNEbfZlmg9fVFBHDqPkNR0bejUoKKeyDvYKx4YG4qyZQFq+zNt:5ghJufi6tXy20Kj2KeyDQKqYXqMQMY

Score

9^/10

Detects executables packed with SmartAssembly 1 IoCs

resource	yara_rule
behavioral2/memory/4416-0-0x00000000004D0000-0x00000000004D8000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Detects files referencing the transfer.sh file sharing website 1 IoCs

resource	yara_rule
behavioral2/memory/4416-0-0x00000000004D0000-0x00000000004D8000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_TransferSh_URL

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4416	36ed94fb9f8ef3f5cbf8494ff6400d0be353ae7c223ed209bd85d466d1ba1ff7.exe

C:\Users\Admin\AppData\Local\Temp\36ed94fb9f8ef3f5cbf8494ff6400d0be353ae7c223ed209bd85d466d1ba1ff7.exe
"C:\Users\Admin\AppData\Local\Temp\36ed94fb9f8ef3f5cbf8494ff6400d0be353ae7c223ed209bd85d466d1ba1ff7.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3992 --field-trial-handle=2260,i,3303482231723870786,2954015409682154873,262144 --variations-seed-version /prefetch:8
1⤵
PID:4324

memory/4416-0-0x00000000004D0000-0x00000000004D8000-memory.dmp

Filesize
32KB

Download
memory/4416-1-0x0000000074640000-0x0000000074DF0000-memory.dmp

Filesize
7.7MB

Download
memory/4416-2-0x0000000004FC0000-0x0000000004FD0000-memory.dmp

Filesize
64KB

Download
memory/4416-3-0x0000000074640000-0x0000000074DF0000-memory.dmp

Filesize
7.7MB

Download
memory/4416-4-0x0000000004FC0000-0x0000000004FD0000-memory.dmp

Filesize
64KB

Download