Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08/04/2024, 11:00
Static task
static1
Behavioral task
behavioral1
Sample
bed28df0f84bee1c3e9c82140ebfc0b85c6e133d300421301385cb24f64d6ca1.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
bed28df0f84bee1c3e9c82140ebfc0b85c6e133d300421301385cb24f64d6ca1.exe
Resource
win10v2004-20240226-en
General
-
Target
bed28df0f84bee1c3e9c82140ebfc0b85c6e133d300421301385cb24f64d6ca1.exe
-
Size
1.3MB
-
MD5
3d989e95603d43f6d1ba28683c2cb615
-
SHA1
821f655a37e28155558fa691a43df27691018218
-
SHA256
bed28df0f84bee1c3e9c82140ebfc0b85c6e133d300421301385cb24f64d6ca1
-
SHA512
3ca8200bfca1837710b8a30623adaac2ad693cd1034ddcaf948405fdfe06f5eed57c1a29037a8a8e62cd5ba1ac52fe3ca90d54f2d89003df1250114aca62c958
-
SSDEEP
24576:x/CKABb7ozX0j52pMkuLoiSJVlIL29mhNq6:xaKkw70jIpM3kiSBM29mhNq
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe bed28df0f84bee1c3e9c82140ebfc0b85c6e133d300421301385cb24f64d6ca1.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3088 bed28df0f84bee1c3e9c82140ebfc0b85c6e133d300421301385cb24f64d6ca1.exe