Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
02/06/2024, 08:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe
Resource
win7-20240508-en
windows7-x64
3 signatures
150 seconds
General
- Target a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe
- Size 26KB
- Sample240602-kl88vsgd4s
- SHA256 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc
- MD5 9043e740e123435dc3be1690bd3bef52
- SHA1 551e82adee59529e080328de1afffebd34599b80
- SHA512 62df10b9cba696b41eb338e4dcac7f41e32aabaf6daaa5f50e03ba4b035a4adaf5ad13aef933974ad5d5076ae0a4cc0fd987f41ed247bb7b8607f04e11f7a664
- SSDEEP 384:oLd6haZIVi/dMkt1cpDkjetHzCYe/RY2OzRLTm3yilqr63gbAt1vGf:Ww0IVi/dMc1uT5e/RsEJ1vGf
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 6 pastebin.com 7 pastebin.com - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: 33 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: SeIncBasePriorityPrivilege 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: 33 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: SeIncBasePriorityPrivilege 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: 33 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: SeIncBasePriorityPrivilege 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: 33 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: SeIncBasePriorityPrivilege 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: 33 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: SeIncBasePriorityPrivilege 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: 33 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: SeIncBasePriorityPrivilege 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: 33 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: SeIncBasePriorityPrivilege 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: 33 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: SeIncBasePriorityPrivilege 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: 33 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: SeIncBasePriorityPrivilege 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: 33 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: SeIncBasePriorityPrivilege 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: 33 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: SeIncBasePriorityPrivilege 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: 33 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: SeIncBasePriorityPrivilege 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: 33 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: SeIncBasePriorityPrivilege 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: 33 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: SeIncBasePriorityPrivilege 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: 33 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: SeIncBasePriorityPrivilege 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: 33 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: SeIncBasePriorityPrivilege 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: 33 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: SeIncBasePriorityPrivilege 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: 33 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: SeIncBasePriorityPrivilege 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: 33 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: SeIncBasePriorityPrivilege 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: 33 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: SeIncBasePriorityPrivilege 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: 33 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: SeIncBasePriorityPrivilege 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: 33 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: SeIncBasePriorityPrivilege 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: 33 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: SeIncBasePriorityPrivilege 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: 33 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: SeIncBasePriorityPrivilege 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: 33 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: SeIncBasePriorityPrivilege 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: 33 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: SeIncBasePriorityPrivilege 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: 33 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: SeIncBasePriorityPrivilege 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: 33 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: SeIncBasePriorityPrivilege 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: 33 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: SeIncBasePriorityPrivilege 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: 33 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: SeIncBasePriorityPrivilege 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: 33 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: SeIncBasePriorityPrivilege 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe Token: 33 2996 a3e44e40cf250b4ab6cc63eeef6c55044a4cf3c6e71c742f0a05e838193898bc.exe