Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
14-03-2024 11:51
Static task
static1
Behavioral task
behavioral1
Sample
瞓4.exe
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral2
Sample
瞓4.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
General
-
Target
瞓4.exe
-
Size
2.1MB
-
MD5
e79b8afcf84ca71086f9382e5f9d78e0
-
SHA1
6932b5019fc9364ad38aaefe65722c16c720519e
-
SHA256
60d7ac25ea2deba9677b304cd2cee4cd594ce1fd471c59f69541693a64829d78
-
SHA512
64ac2f25849c0acb5ab67d03b5d713ed769e3868f4e367457c4dd3c9af05b3cbf4d0591e64717a9aca4a8ee1a7f6cb61be6a22639739bb2dfe9acd40e6154106
-
SSDEEP
24576:aDapgTHBErT1Vyk4xpsZ/SvfG5VMhcLcEI4PqsCfcweEXCHBIZ040Q5Uv+EinI:amb4qMZp4PqtKEXChrQm+I
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeDebugPrivilege 1696 瞓4.exe Token: 1 1696 瞓4.exe Token: SeCreateTokenPrivilege 1696 瞓4.exe Token: SeAssignPrimaryTokenPrivilege 1696 瞓4.exe Token: SeLockMemoryPrivilege 1696 瞓4.exe Token: SeIncreaseQuotaPrivilege 1696 瞓4.exe Token: SeMachineAccountPrivilege 1696 瞓4.exe Token: SeTcbPrivilege 1696 瞓4.exe Token: SeSecurityPrivilege 1696 瞓4.exe Token: SeTakeOwnershipPrivilege 1696 瞓4.exe Token: SeLoadDriverPrivilege 1696 瞓4.exe Token: SeSystemProfilePrivilege 1696 瞓4.exe Token: SeSystemtimePrivilege 1696 瞓4.exe Token: SeProfSingleProcessPrivilege 1696 瞓4.exe Token: SeIncBasePriorityPrivilege 1696 瞓4.exe Token: SeCreatePagefilePrivilege 1696 瞓4.exe Token: SeCreatePermanentPrivilege 1696 瞓4.exe Token: SeBackupPrivilege 1696 瞓4.exe Token: SeRestorePrivilege 1696 瞓4.exe Token: SeShutdownPrivilege 1696 瞓4.exe Token: SeDebugPrivilege 1696 瞓4.exe Token: SeAuditPrivilege 1696 瞓4.exe Token: SeSystemEnvironmentPrivilege 1696 瞓4.exe Token: SeChangeNotifyPrivilege 1696 瞓4.exe Token: SeRemoteShutdownPrivilege 1696 瞓4.exe Token: SeUndockPrivilege 1696 瞓4.exe Token: SeSyncAgentPrivilege 1696 瞓4.exe Token: SeEnableDelegationPrivilege 1696 瞓4.exe Token: SeManageVolumePrivilege 1696 瞓4.exe Token: SeImpersonatePrivilege 1696 瞓4.exe Token: SeCreateGlobalPrivilege 1696 瞓4.exe Token: 31 1696 瞓4.exe Token: 32 1696 瞓4.exe Token: 33 1696 瞓4.exe Token: 34 1696 瞓4.exe Token: 35 1696 瞓4.exe Token: 36 1696 瞓4.exe Token: 37 1696 瞓4.exe Token: 38 1696 瞓4.exe Token: 39 1696 瞓4.exe Token: 40 1696 瞓4.exe Token: 41 1696 瞓4.exe Token: 42 1696 瞓4.exe Token: 43 1696 瞓4.exe Token: 44 1696 瞓4.exe Token: 45 1696 瞓4.exe Token: 46 1696 瞓4.exe Token: 47 1696 瞓4.exe Token: 48 1696 瞓4.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1696 瞓4.exe 1696 瞓4.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32B
MD51b42b5673d8cc2c9c86b9aa1e19e9597
SHA182ab224cbb11e3ad6a4e1b181a3e6caa09e7d081
SHA2568726fbc85eb8110c869e8f8e1b0d09eeb9be88925877d2b5ddcc10d16d184e21
SHA512f1ac229fb8b58b2f7d2d93394d7e34c8a69bd0d5bb9fc86154789b434391fcccd101a5e09b993c4760b9352e46e2dccac6ee645f560f9fe4e2cf6611099ee289