Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
18-03-2024 14:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
inj_ruoff.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
inj_ruoff.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
inject.dll
Resource
win7-20240220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
inject.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
l2pbx.exe
Resource
win7-20231129-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
l2pbx.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
l2pbx.exe
-
Size
2.0MB
-
MD5
d4ffe7d1c2730dd73145bcd1a10ed023
-
SHA1
43e6ede026ce6d4a14c63f5f883846dd487f7d2b
-
SHA256
abd09d21de3f2be757b451933cf9533f2abb0c598f3a6ed45ef786b4835bb5dc
-
SHA512
4a9055f08f50bcd0e8029f1f2a2d756cbc5f9b017cf57e52cb6fd51f6e5b58579bf363e7c0ce57db9dfe49ac5f345a4fb7883918117c3a53c8ee5e90215685e3
-
SSDEEP
24576:NVPSbCedGHIKbxjVLMp3OwN0x5m0/2Iyiv7pC3IMn48q1yk6KKjlANCn1u:NVKPde12gm0ZyKpC4dl0bl/1u
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe 3292 l2pbx.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe Token: SeDebugPrivilege 3292 l2pbx.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3292 l2pbx.exe 3292 l2pbx.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 3292 l2pbx.exe 3292 l2pbx.exe