Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 08:10
Behavioral task
behavioral1
Sample
37796f822a449ad9545acbb938f741fb4e4c2f0b63183b4bd2d39108fee576d4.exe
Resource
win7-20240419-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
37796f822a449ad9545acbb938f741fb4e4c2f0b63183b4bd2d39108fee576d4.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
37796f822a449ad9545acbb938f741fb4e4c2f0b63183b4bd2d39108fee576d4.exe
-
Size
1.8MB
-
MD5
c5caa22cbd3841a7701dc27fc81af085
-
SHA1
4187e61ff0a497ce870dd5714f95ee66041faecf
-
SHA256
37796f822a449ad9545acbb938f741fb4e4c2f0b63183b4bd2d39108fee576d4
-
SHA512
7595510d82182370092fa4d612481501f84358125d168e596f11fd8af969a8b7d8600f140a901624fb4c670e518a6fdaf8be7643a6b1efb70d929973f0bd7747
-
SSDEEP
49152:29UAxBrFrrDgPShmxzBoZvvwFUs73LM+oep0/RkeuZlW7D+:q5hmM9vuUk3w/ep0ZsZlW/
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1860-0-0x0000000000400000-0x000000000096C000-memory.dmp upx behavioral1/memory/1860-2-0x0000000000400000-0x000000000096C000-memory.dmp upx -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1860 37796f822a449ad9545acbb938f741fb4e4c2f0b63183b4bd2d39108fee576d4.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1860 37796f822a449ad9545acbb938f741fb4e4c2f0b63183b4bd2d39108fee576d4.exe 1860 37796f822a449ad9545acbb938f741fb4e4c2f0b63183b4bd2d39108fee576d4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\37796f822a449ad9545acbb938f741fb4e4c2f0b63183b4bd2d39108fee576d4.exe"C:\Users\Admin\AppData\Local\Temp\37796f822a449ad9545acbb938f741fb4e4c2f0b63183b4bd2d39108fee576d4.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1860