Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
13/03/2024, 04:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c4fc4cbe8754288ac6c30c0ab41014f1.exe
Resource
win7-20240215-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
c4fc4cbe8754288ac6c30c0ab41014f1.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
c4fc4cbe8754288ac6c30c0ab41014f1.exe
-
Size
534KB
-
MD5
c4fc4cbe8754288ac6c30c0ab41014f1
-
SHA1
fadffa591e3ec4fefd6d3afe7ade216cf3760eeb
-
SHA256
52185ebd20bfb3e754d8f739e607096e4f4d79f506a5698f4ca90864f08fa81c
-
SHA512
86fb5a897faa97703554f7ebbc5cd6da53cd3d3ded3d8fbcc182e0e989fe8bd7f0f1d0448d3c51a9ff608f918df1ecc397ec990e55e11228ac40ae5fb877f7d7
-
SSDEEP
12288:AgM8ASY7VByYol8oTSMb7a41qm/L/GKcv/Pl2SpPNwO:AL7yviUSQaP0KKOl2SI
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe -
Suspicious use of AdjustPrivilegeToken 29 IoCs
description pid Process Token: SeDebugPrivilege 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe Token: 33 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe Token: SeIncBasePriorityPrivilege 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe Token: 33 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe Token: SeIncBasePriorityPrivilege 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe Token: 33 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe Token: SeIncBasePriorityPrivilege 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe Token: 33 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe Token: SeIncBasePriorityPrivilege 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe Token: 33 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe Token: SeIncBasePriorityPrivilege 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe Token: 33 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe Token: SeIncBasePriorityPrivilege 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe Token: 33 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe Token: SeIncBasePriorityPrivilege 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe Token: 33 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe Token: SeIncBasePriorityPrivilege 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe Token: 33 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe Token: SeIncBasePriorityPrivilege 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe Token: 33 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe Token: SeIncBasePriorityPrivilege 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe Token: 33 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe Token: SeIncBasePriorityPrivilege 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe Token: 33 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe Token: SeIncBasePriorityPrivilege 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe Token: 33 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe Token: SeIncBasePriorityPrivilege 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe Token: 33 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe Token: SeIncBasePriorityPrivilege 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3028 c4fc4cbe8754288ac6c30c0ab41014f1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4fc4cbe8754288ac6c30c0ab41014f1.exe"C:\Users\Admin\AppData\Local\Temp\c4fc4cbe8754288ac6c30c0ab41014f1.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3028