4959104f5de4fb8ec18dc70d1f67a99415be105b3a9ed775d9147a106fa2c202

Analysis

max time kernel
121s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 02:36

Target

4959104f5de4fb8ec18dc70d1f67a99415be105b3a9ed775d9147a106fa2c202.exe
Size

703KB
MD5

2fa628c2aa39d0812a97ad6837d69512
SHA1

b9ddecb08cff1acbb33f04b1c034e336444bbc90
SHA256

4959104f5de4fb8ec18dc70d1f67a99415be105b3a9ed775d9147a106fa2c202
SHA512

9795d3a436ebada89387064b775237fd200be4a01f43faa96e0951d20a96ccd17ab8a9988f4799cb774226fa5150472326495842cf6f36d362e2a296133744a6
SSDEEP

192:xPuTunAtt5Pg1lld07xFVd4yywe/2D4Ec7KdT:tYcAP+PlOzVdNpe/REmi

Score

6^/10

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	ip-api.com

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2296	4959104f5de4fb8ec18dc70d1f67a99415be105b3a9ed775d9147a106fa2c202.exe

C:\Users\Admin\AppData\Local\Temp\4959104f5de4fb8ec18dc70d1f67a99415be105b3a9ed775d9147a106fa2c202.exe
"C:\Users\Admin\AppData\Local\Temp\4959104f5de4fb8ec18dc70d1f67a99415be105b3a9ed775d9147a106fa2c202.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2268 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
1⤵
PID:1324

memory/2296-0-0x000000007491E000-0x000000007491F000-memory.dmp

Filesize
4KB

Download
memory/2296-1-0x0000000000760000-0x000000000076A000-memory.dmp

Filesize
40KB

Download
memory/2296-2-0x00000000050E0000-0x0000000005172000-memory.dmp

Filesize
584KB

Download
memory/2296-3-0x0000000074910000-0x00000000750C0000-memory.dmp

Filesize
7.7MB

Download
memory/2296-4-0x0000000005970000-0x0000000005F14000-memory.dmp

Filesize
5.6MB

Download
memory/2296-5-0x00000000061D0000-0x0000000006236000-memory.dmp

Filesize
408KB

Download
memory/2296-6-0x000000007491E000-0x000000007491F000-memory.dmp

Filesize
4KB

Download
memory/2296-7-0x0000000074910000-0x00000000750C0000-memory.dmp

Filesize
7.7MB

Download