Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
19-04-2024 17:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe
Resource
win7-20240220-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe
-
Size
36KB
-
MD5
15c643ee1f546c01e685dba30164489f
-
SHA1
7b13974fcbd21edcfa0c910d25d27ba1eead8a43
-
SHA256
60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3
-
SHA512
268e63aabbd7f156234f6c920f158d77abe5131b701409348895b709039a63d14199887aa2df0b07f0c06edcfb3ffbd24728973ed0bb034db12fec6e48ed4141
-
SSDEEP
384:GLd2LzreBCAuKiEZePC45SY2OzRLTm3yilqr6L1bHyvGj:gizrecPEZeK45SssovGj
Score
10/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\Server.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe\"" 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
flow ioc 4 pastebin.com 5 pastebin.com 6 0.tcp.sa.ngrok.io 39 0.tcp.sa.ngrok.io 69 0.tcp.sa.ngrok.io -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 2240 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe