Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16/06/2024, 03:15
Static task
static1
Behavioral task
behavioral1
Sample
c18a9ae6f849639a72e49c9d837d33d16f73b6dc55956db869569dd5cd7fe446.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c18a9ae6f849639a72e49c9d837d33d16f73b6dc55956db869569dd5cd7fe446.exe
Resource
win10v2004-20240508-en
General
-
Target
c18a9ae6f849639a72e49c9d837d33d16f73b6dc55956db869569dd5cd7fe446.exe
-
Size
1.3MB
-
MD5
5db7f27cd8894bbef0626136368d050b
-
SHA1
f0b8bdcae7edd07cc49fca1eb8c517edee24cbeb
-
SHA256
c18a9ae6f849639a72e49c9d837d33d16f73b6dc55956db869569dd5cd7fe446
-
SHA512
08535b4171dbfbc90b0d35e5537f4cbe9099b406422f541b239d171e32a0d92ceb360abfd22d1d40f4a8e1a0715741fd41903f322aa5e52c7585da3333cbf2cb
-
SSDEEP
12288:uE9B+VrUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:uE9Boatr0zAiX90z/F0jsFB3SQk
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe c18a9ae6f849639a72e49c9d837d33d16f73b6dc55956db869569dd5cd7fe446.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2864 c18a9ae6f849639a72e49c9d837d33d16f73b6dc55956db869569dd5cd7fe446.exe