Analysis
-
max time kernel
149s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
25/05/2024, 18:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe
-
Size
7.3MB
-
MD5
bf11dfef1411d68cbc3a67b40719d751
-
SHA1
96e7555e8d38e880b982391ef00710008803d8f0
-
SHA256
ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9
-
SHA512
8ff444788f57f5b5131c07a6f32386a8cabd80ebe6848b75098f3eb59f39027f48575e687597419e7284b012063cb3ed8d16693013c3ed3586ba142fce2663cd
-
SSDEEP
98304:gHzkJNmMTcsDBBU/bnXH0/XRaGxHcBYbI9sjd3sHoF32tDQKDYajb3dCcN5hu3iV:gTgTco+7UFHcOgiJsHcGBbfjb3dD9Gi
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe 2332 ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe"C:\Users\Admin\AppData\Local\Temp\ff3783cfa545a368dec6e0d7a50890a8226b89f68b41f5e265e3f5aa8cb591a9.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2332