Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12-06-2024 08:40
Static task
static1
Behavioral task
behavioral1
Sample
ef6ec11b4e0981294e55747ca85c84bd65ca9a69922fc73fe5fe36f7365d503e.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
ef6ec11b4e0981294e55747ca85c84bd65ca9a69922fc73fe5fe36f7365d503e.exe
Resource
win10v2004-20240508-en
General
-
Target
ef6ec11b4e0981294e55747ca85c84bd65ca9a69922fc73fe5fe36f7365d503e.exe
-
Size
7.3MB
-
MD5
316b4c023ed3c46283fbf1d0b7f16f77
-
SHA1
87399f2b21d34a0a65400dbb25d0f3dce3a6be82
-
SHA256
ef6ec11b4e0981294e55747ca85c84bd65ca9a69922fc73fe5fe36f7365d503e
-
SHA512
729c89b735828cceca89197200e03e21ce238748ab3bf1c7bb6aca9378b4b5e21321b675a9e6d4494d9f47eb71746d84f14e036c22e0514e9f964892761029c5
-
SSDEEP
196608:yKizOgDGQ9+lebVRMHVx5zY3TcrbUeosr+OYdPeEv:yrzOgDGQ9gebV+HV8Oz/YdPeEv
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 4804 ef6ec11b4e0981294e55747ca85c84bd65ca9a69922fc73fe5fe36f7365d503e.exe Token: SeRestorePrivilege 4804 ef6ec11b4e0981294e55747ca85c84bd65ca9a69922fc73fe5fe36f7365d503e.exe Token: SeBackupPrivilege 4804 ef6ec11b4e0981294e55747ca85c84bd65ca9a69922fc73fe5fe36f7365d503e.exe Token: SeTakeOwnershipPrivilege 4804 ef6ec11b4e0981294e55747ca85c84bd65ca9a69922fc73fe5fe36f7365d503e.exe Token: SeSecurityPrivilege 4804 ef6ec11b4e0981294e55747ca85c84bd65ca9a69922fc73fe5fe36f7365d503e.exe Token: SeIncreaseQuotaPrivilege 4804 ef6ec11b4e0981294e55747ca85c84bd65ca9a69922fc73fe5fe36f7365d503e.exe Token: SeImpersonatePrivilege 4804 ef6ec11b4e0981294e55747ca85c84bd65ca9a69922fc73fe5fe36f7365d503e.exe Token: SeChangeNotifyPrivilege 4804 ef6ec11b4e0981294e55747ca85c84bd65ca9a69922fc73fe5fe36f7365d503e.exe Token: SeIncBasePriorityPrivilege 4804 ef6ec11b4e0981294e55747ca85c84bd65ca9a69922fc73fe5fe36f7365d503e.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4804 ef6ec11b4e0981294e55747ca85c84bd65ca9a69922fc73fe5fe36f7365d503e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef6ec11b4e0981294e55747ca85c84bd65ca9a69922fc73fe5fe36f7365d503e.exe"C:\Users\Admin\AppData\Local\Temp\ef6ec11b4e0981294e55747ca85c84bd65ca9a69922fc73fe5fe36f7365d503e.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4804