Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 10:36
Static task
static1
Behavioral task
behavioral1
Sample
0b684d20eef9e48b778bac66117cc1c62ae648dc2fdde1f8ced3ce68873ccc74.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
0b684d20eef9e48b778bac66117cc1c62ae648dc2fdde1f8ced3ce68873ccc74.exe
Resource
win10v2004-20240426-en
General
-
Target
0b684d20eef9e48b778bac66117cc1c62ae648dc2fdde1f8ced3ce68873ccc74.exe
-
Size
694KB
-
MD5
499a0ac48a43e78061f006f20bd9b9ae
-
SHA1
8fb699a6f594026874f9a6e857aea03691366902
-
SHA256
0b684d20eef9e48b778bac66117cc1c62ae648dc2fdde1f8ced3ce68873ccc74
-
SHA512
e088b77f911b82ba4ee2ca35cc0a37322e0bd2d1d03b908c22915fdf03b87c869d416373e8cbc1e54ecb4366f72720635a11c61934a0e7c2a9dd3287f7d7add2
-
SSDEEP
12288:f5F6HkkoFY9OFNTBE9kt1nop50xBmT6o/78+iTBmhse6IdNxtR2t4DX+:f+8NlE9kt1nopixBmT6s78zBmhsvinKw
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 3056 0b684d20eef9e48b778bac66117cc1c62ae648dc2fdde1f8ced3ce68873ccc74.exe 3056 0b684d20eef9e48b778bac66117cc1c62ae648dc2fdde1f8ced3ce68873ccc74.exe 3056 0b684d20eef9e48b778bac66117cc1c62ae648dc2fdde1f8ced3ce68873ccc74.exe 3056 0b684d20eef9e48b778bac66117cc1c62ae648dc2fdde1f8ced3ce68873ccc74.exe 3056 0b684d20eef9e48b778bac66117cc1c62ae648dc2fdde1f8ced3ce68873ccc74.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3056 0b684d20eef9e48b778bac66117cc1c62ae648dc2fdde1f8ced3ce68873ccc74.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 3056 wrote to memory of 2620 3056 0b684d20eef9e48b778bac66117cc1c62ae648dc2fdde1f8ced3ce68873ccc74.exe 28 PID 3056 wrote to memory of 2620 3056 0b684d20eef9e48b778bac66117cc1c62ae648dc2fdde1f8ced3ce68873ccc74.exe 28 PID 3056 wrote to memory of 2620 3056 0b684d20eef9e48b778bac66117cc1c62ae648dc2fdde1f8ced3ce68873ccc74.exe 28 PID 3056 wrote to memory of 2620 3056 0b684d20eef9e48b778bac66117cc1c62ae648dc2fdde1f8ced3ce68873ccc74.exe 28 PID 3056 wrote to memory of 2628 3056 0b684d20eef9e48b778bac66117cc1c62ae648dc2fdde1f8ced3ce68873ccc74.exe 29 PID 3056 wrote to memory of 2628 3056 0b684d20eef9e48b778bac66117cc1c62ae648dc2fdde1f8ced3ce68873ccc74.exe 29 PID 3056 wrote to memory of 2628 3056 0b684d20eef9e48b778bac66117cc1c62ae648dc2fdde1f8ced3ce68873ccc74.exe 29 PID 3056 wrote to memory of 2628 3056 0b684d20eef9e48b778bac66117cc1c62ae648dc2fdde1f8ced3ce68873ccc74.exe 29 PID 3056 wrote to memory of 2696 3056 0b684d20eef9e48b778bac66117cc1c62ae648dc2fdde1f8ced3ce68873ccc74.exe 30 PID 3056 wrote to memory of 2696 3056 0b684d20eef9e48b778bac66117cc1c62ae648dc2fdde1f8ced3ce68873ccc74.exe 30 PID 3056 wrote to memory of 2696 3056 0b684d20eef9e48b778bac66117cc1c62ae648dc2fdde1f8ced3ce68873ccc74.exe 30 PID 3056 wrote to memory of 2696 3056 0b684d20eef9e48b778bac66117cc1c62ae648dc2fdde1f8ced3ce68873ccc74.exe 30 PID 3056 wrote to memory of 2700 3056 0b684d20eef9e48b778bac66117cc1c62ae648dc2fdde1f8ced3ce68873ccc74.exe 31 PID 3056 wrote to memory of 2700 3056 0b684d20eef9e48b778bac66117cc1c62ae648dc2fdde1f8ced3ce68873ccc74.exe 31 PID 3056 wrote to memory of 2700 3056 0b684d20eef9e48b778bac66117cc1c62ae648dc2fdde1f8ced3ce68873ccc74.exe 31 PID 3056 wrote to memory of 2700 3056 0b684d20eef9e48b778bac66117cc1c62ae648dc2fdde1f8ced3ce68873ccc74.exe 31 PID 3056 wrote to memory of 2780 3056 0b684d20eef9e48b778bac66117cc1c62ae648dc2fdde1f8ced3ce68873ccc74.exe 32 PID 3056 wrote to memory of 2780 3056 0b684d20eef9e48b778bac66117cc1c62ae648dc2fdde1f8ced3ce68873ccc74.exe 32 PID 3056 wrote to memory of 2780 3056 0b684d20eef9e48b778bac66117cc1c62ae648dc2fdde1f8ced3ce68873ccc74.exe 32 PID 3056 wrote to memory of 2780 3056 0b684d20eef9e48b778bac66117cc1c62ae648dc2fdde1f8ced3ce68873ccc74.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b684d20eef9e48b778bac66117cc1c62ae648dc2fdde1f8ced3ce68873ccc74.exe"C:\Users\Admin\AppData\Local\Temp\0b684d20eef9e48b778bac66117cc1c62ae648dc2fdde1f8ced3ce68873ccc74.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\0b684d20eef9e48b778bac66117cc1c62ae648dc2fdde1f8ced3ce68873ccc74.exe"C:\Users\Admin\AppData\Local\Temp\0b684d20eef9e48b778bac66117cc1c62ae648dc2fdde1f8ced3ce68873ccc74.exe"2⤵PID:2620
-
-
C:\Users\Admin\AppData\Local\Temp\0b684d20eef9e48b778bac66117cc1c62ae648dc2fdde1f8ced3ce68873ccc74.exe"C:\Users\Admin\AppData\Local\Temp\0b684d20eef9e48b778bac66117cc1c62ae648dc2fdde1f8ced3ce68873ccc74.exe"2⤵PID:2628
-
-
C:\Users\Admin\AppData\Local\Temp\0b684d20eef9e48b778bac66117cc1c62ae648dc2fdde1f8ced3ce68873ccc74.exe"C:\Users\Admin\AppData\Local\Temp\0b684d20eef9e48b778bac66117cc1c62ae648dc2fdde1f8ced3ce68873ccc74.exe"2⤵PID:2696
-
-
C:\Users\Admin\AppData\Local\Temp\0b684d20eef9e48b778bac66117cc1c62ae648dc2fdde1f8ced3ce68873ccc74.exe"C:\Users\Admin\AppData\Local\Temp\0b684d20eef9e48b778bac66117cc1c62ae648dc2fdde1f8ced3ce68873ccc74.exe"2⤵PID:2700
-
-
C:\Users\Admin\AppData\Local\Temp\0b684d20eef9e48b778bac66117cc1c62ae648dc2fdde1f8ced3ce68873ccc74.exe"C:\Users\Admin\AppData\Local\Temp\0b684d20eef9e48b778bac66117cc1c62ae648dc2fdde1f8ced3ce68873ccc74.exe"2⤵PID:2780
-