Analysis
-
max time kernel
119s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 22:39
Static task
static1
Behavioral task
behavioral1
Sample
3912fe2b0e9cb40d52f413ab70df3afbdd732d195ed4c3d128387dc58dc82722.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
3912fe2b0e9cb40d52f413ab70df3afbdd732d195ed4c3d128387dc58dc82722.exe
Resource
win10v2004-20240508-en
General
-
Target
3912fe2b0e9cb40d52f413ab70df3afbdd732d195ed4c3d128387dc58dc82722.exe
-
Size
7.2MB
-
MD5
9fe9e218d2dcdb977440ae91d0068fcb
-
SHA1
e041c4da1d0b50aab5b82d528e19fe105d3b12b6
-
SHA256
3912fe2b0e9cb40d52f413ab70df3afbdd732d195ed4c3d128387dc58dc82722
-
SHA512
733c226b4146246e0dd52742d714d01fa442494d1ea3f628f45aeb0895a8c524e4d42b9194142005ba6d17f5b97343ef0bf99254382b2c2ae13a3d3858e93179
-
SSDEEP
49152:US5HpffAvSqlG4a20gbi8G3OCRgvocnoq+PQwfvZmXxorRA+s8KuqGaX0ToIBAUB:bJffslG410gbsdP1ZL1JBAUZL02
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
3912fe2b0e9cb40d52f413ab70df3afbdd732d195ed4c3d128387dc58dc82722.exepid process 2164 3912fe2b0e9cb40d52f413ab70df3afbdd732d195ed4c3d128387dc58dc82722.exe 2164 3912fe2b0e9cb40d52f413ab70df3afbdd732d195ed4c3d128387dc58dc82722.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
3912fe2b0e9cb40d52f413ab70df3afbdd732d195ed4c3d128387dc58dc82722.exedescription pid process Token: SeDebugPrivilege 2164 3912fe2b0e9cb40d52f413ab70df3afbdd732d195ed4c3d128387dc58dc82722.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
3912fe2b0e9cb40d52f413ab70df3afbdd732d195ed4c3d128387dc58dc82722.exepid process 2164 3912fe2b0e9cb40d52f413ab70df3afbdd732d195ed4c3d128387dc58dc82722.exe 2164 3912fe2b0e9cb40d52f413ab70df3afbdd732d195ed4c3d128387dc58dc82722.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3912fe2b0e9cb40d52f413ab70df3afbdd732d195ed4c3d128387dc58dc82722.exe"C:\Users\Admin\AppData\Local\Temp\3912fe2b0e9cb40d52f413ab70df3afbdd732d195ed4c3d128387dc58dc82722.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2164