Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
03/06/2024, 10:39
Static task
static1
Behavioral task
behavioral1
Sample
629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe
Resource
win10v2004-20240226-en
General
-
Target
629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe
-
Size
6.4MB
-
MD5
a24fc4f0bc661443244f5928ee57d690
-
SHA1
c637dce1dd82fb8c788383d2fd4e8a8b25922b88
-
SHA256
629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96
-
SHA512
086192deaa29e44493c445e0d624bc809b1ec05370da3bde263170b752d9bd120d2317e1be6ff7439b75c7b94e4632b3cbb01ce87abc4692d99ed60987809a22
-
SSDEEP
49152:YmblsDi8QyfAffcHhlXpBi+1VhlXpBi+crVFUOIc6F4wIAeL4PCpE/vsWvrZsI8k:Ll0i8QyfAftAeLWCJ4ubQ
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeDebugPrivilege 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: 1 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: SeCreateTokenPrivilege 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: SeAssignPrimaryTokenPrivilege 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: SeLockMemoryPrivilege 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: SeIncreaseQuotaPrivilege 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: SeMachineAccountPrivilege 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: SeTcbPrivilege 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: SeSecurityPrivilege 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: SeTakeOwnershipPrivilege 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: SeLoadDriverPrivilege 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: SeSystemProfilePrivilege 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: SeSystemtimePrivilege 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: SeProfSingleProcessPrivilege 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: SeIncBasePriorityPrivilege 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: SeCreatePagefilePrivilege 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: SeCreatePermanentPrivilege 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: SeBackupPrivilege 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: SeRestorePrivilege 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: SeShutdownPrivilege 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: SeDebugPrivilege 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: SeAuditPrivilege 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: SeSystemEnvironmentPrivilege 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: SeChangeNotifyPrivilege 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: SeRemoteShutdownPrivilege 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: SeUndockPrivilege 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: SeSyncAgentPrivilege 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: SeEnableDelegationPrivilege 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: SeManageVolumePrivilege 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: SeImpersonatePrivilege 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: SeCreateGlobalPrivilege 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: 31 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: 32 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: 33 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: 34 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: 35 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: 36 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: 37 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: 38 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: 39 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: 40 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: 41 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: 42 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: 43 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: 44 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: 45 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: 46 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: 47 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe Token: 48 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe 2972 629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe"C:\Users\Admin\AppData\Local\Temp\629bd096ff76fc4b8f3ee397480832409290d4520edd19e97e3f62507de40e96.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2972