Analysis
-
max time kernel
159s -
max time network
168s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
19/04/2024, 17:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe
Resource
win7-20240220-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe
-
Size
36KB
-
MD5
15c643ee1f546c01e685dba30164489f
-
SHA1
7b13974fcbd21edcfa0c910d25d27ba1eead8a43
-
SHA256
60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3
-
SHA512
268e63aabbd7f156234f6c920f158d77abe5131b701409348895b709039a63d14199887aa2df0b07f0c06edcfb3ffbd24728973ed0bb034db12fec6e48ed4141
-
SSDEEP
384:GLd2LzreBCAuKiEZePC45SY2OzRLTm3yilqr6L1bHyvGj:gizrecPEZeK45SssovGj
Score
10/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Server.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe\"" 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
flow ioc 21 pastebin.com 22 pastebin.com 24 0.tcp.sa.ngrok.io 46 0.tcp.sa.ngrok.io 75 0.tcp.sa.ngrok.io -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: SeIncBasePriorityPrivilege 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe Token: 33 3040 60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe"C:\Users\Admin\AppData\Local\Temp\60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3.exe"1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:3040
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3104 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:81⤵PID:5376