Analysis
- max time kernel
141s - max time network
98s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2024, 03:55
Behavioral task
behavioral1
Sample
c84b649b6e2e1f7ac65b5d7a28b95ff8ef7a3c8e163db83273d3f83accf7a6cf.exe
Resource
win7-20240611-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
c84b649b6e2e1f7ac65b5d7a28b95ff8ef7a3c8e163db83273d3f83accf7a6cf.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target c84b649b6e2e1f7ac65b5d7a28b95ff8ef7a3c8e163db83273d3f83accf7a6cf.exe
- Size 48KB
- Sample240614-eham8sthnf
- SHA256 c84b649b6e2e1f7ac65b5d7a28b95ff8ef7a3c8e163db83273d3f83accf7a6cf
- MD5 40d33bfaeecd5f3cf6daffe95ff9c781
- SHA1 fa73665403965b58836751dd40623c8c34af6ed6
- SHA512 983475cec4032010abbc8339dc508aef0f2947e6c55fe26404aad5cdac4b20178beede09b6a67bd2fecbee5e7fc1977f88c77ea48ca708b9282d53e4e28fc730
- SSDEEP 384:i3bTz4qa1C6+c0W5sv3blILQbyumtZD8GTPITz09/+EW5M6J:iTqrsv35ILQbyumtZgGTgKFT
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- UPX dump on OEP (original entry point) 2 IoCs
resource yara_rule behavioral2/memory/1632-0-0x0000000000CF0000-0x0000000000D34000-memory.dmp UPX behavioral2/memory/1632-1-0x0000000000CF0000-0x0000000000D34000-memory.dmp UPX -
resource yara_rule behavioral2/memory/1632-0-0x0000000000CF0000-0x0000000000D34000-memory.dmp upx behavioral2/memory/1632-1-0x0000000000CF0000-0x0000000000D34000-memory.dmp upx - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1632 c84b649b6e2e1f7ac65b5d7a28b95ff8ef7a3c8e163db83273d3f83accf7a6cf.exe 1632 c84b649b6e2e1f7ac65b5d7a28b95ff8ef7a3c8e163db83273d3f83accf7a6cf.exe - Suspicious use of AdjustPrivilegeToken 21 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1632 c84b649b6e2e1f7ac65b5d7a28b95ff8ef7a3c8e163db83273d3f83accf7a6cf.exe Token: SeSecurityPrivilege 1632 c84b649b6e2e1f7ac65b5d7a28b95ff8ef7a3c8e163db83273d3f83accf7a6cf.exe Token: SeTakeOwnershipPrivilege 1632 c84b649b6e2e1f7ac65b5d7a28b95ff8ef7a3c8e163db83273d3f83accf7a6cf.exe Token: SeLoadDriverPrivilege 1632 c84b649b6e2e1f7ac65b5d7a28b95ff8ef7a3c8e163db83273d3f83accf7a6cf.exe Token: SeSystemProfilePrivilege 1632 c84b649b6e2e1f7ac65b5d7a28b95ff8ef7a3c8e163db83273d3f83accf7a6cf.exe Token: SeSystemtimePrivilege 1632 c84b649b6e2e1f7ac65b5d7a28b95ff8ef7a3c8e163db83273d3f83accf7a6cf.exe Token: SeProfSingleProcessPrivilege 1632 c84b649b6e2e1f7ac65b5d7a28b95ff8ef7a3c8e163db83273d3f83accf7a6cf.exe Token: SeIncBasePriorityPrivilege 1632 c84b649b6e2e1f7ac65b5d7a28b95ff8ef7a3c8e163db83273d3f83accf7a6cf.exe Token: SeCreatePagefilePrivilege 1632 c84b649b6e2e1f7ac65b5d7a28b95ff8ef7a3c8e163db83273d3f83accf7a6cf.exe Token: SeBackupPrivilege 1632 c84b649b6e2e1f7ac65b5d7a28b95ff8ef7a3c8e163db83273d3f83accf7a6cf.exe Token: SeRestorePrivilege 1632 c84b649b6e2e1f7ac65b5d7a28b95ff8ef7a3c8e163db83273d3f83accf7a6cf.exe Token: SeShutdownPrivilege 1632 c84b649b6e2e1f7ac65b5d7a28b95ff8ef7a3c8e163db83273d3f83accf7a6cf.exe Token: SeDebugPrivilege 1632 c84b649b6e2e1f7ac65b5d7a28b95ff8ef7a3c8e163db83273d3f83accf7a6cf.exe Token: SeSystemEnvironmentPrivilege 1632 c84b649b6e2e1f7ac65b5d7a28b95ff8ef7a3c8e163db83273d3f83accf7a6cf.exe Token: SeRemoteShutdownPrivilege 1632 c84b649b6e2e1f7ac65b5d7a28b95ff8ef7a3c8e163db83273d3f83accf7a6cf.exe Token: SeUndockPrivilege 1632 c84b649b6e2e1f7ac65b5d7a28b95ff8ef7a3c8e163db83273d3f83accf7a6cf.exe Token: SeManageVolumePrivilege 1632 c84b649b6e2e1f7ac65b5d7a28b95ff8ef7a3c8e163db83273d3f83accf7a6cf.exe Token: 33 1632 c84b649b6e2e1f7ac65b5d7a28b95ff8ef7a3c8e163db83273d3f83accf7a6cf.exe Token: 34 1632 c84b649b6e2e1f7ac65b5d7a28b95ff8ef7a3c8e163db83273d3f83accf7a6cf.exe Token: 35 1632 c84b649b6e2e1f7ac65b5d7a28b95ff8ef7a3c8e163db83273d3f83accf7a6cf.exe Token: 36 1632 c84b649b6e2e1f7ac65b5d7a28b95ff8ef7a3c8e163db83273d3f83accf7a6cf.exe