Analysis
-
max time kernel
140s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
15/03/2024, 15:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cbbf061965a1122f314c0943fc40cee0.exe
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
cbbf061965a1122f314c0943fc40cee0.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
cbbf061965a1122f314c0943fc40cee0.exe
-
Size
10KB
-
MD5
cbbf061965a1122f314c0943fc40cee0
-
SHA1
4cd698b718718f464caa65ac6abd34c8fb9e17af
-
SHA256
283f13a7e22747d12696fdb13c958da1081eecc92a54bedc8cb76420f094fe32
-
SHA512
9d8e4f74d66793643f255030ab4648c366f243dfc5156b42e6789d1f450025ccde1f5607af988e0334ea8fc978e919aa213c4a2f97fc48d46fbf4206845506c9
-
SSDEEP
192:zLYYbtYpmksk2okkDu8Ua4I5SESkrUVxq1UEJeYg1:/lGNUa4sSEbrUIi
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe 2324 cbbf061965a1122f314c0943fc40cee0.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2324 cbbf061965a1122f314c0943fc40cee0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cbbf061965a1122f314c0943fc40cee0.exe"C:\Users\Admin\AppData\Local\Temp\cbbf061965a1122f314c0943fc40cee0.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2324
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3276 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:81⤵PID:3076