Analysis
-
max time kernel
93s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30/06/2024, 01:13
Static task
static1
Behavioral task
behavioral1
Sample
16436b1b6eb9f4649918cec9b716b90ef8a05ad380a3a5777cdde2a53817ebde.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
16436b1b6eb9f4649918cec9b716b90ef8a05ad380a3a5777cdde2a53817ebde.exe
Resource
win10v2004-20240508-en
General
-
Target
16436b1b6eb9f4649918cec9b716b90ef8a05ad380a3a5777cdde2a53817ebde.exe
-
Size
10.5MB
-
MD5
c1da5c7abf0bd52d13c92a05ce0907f3
-
SHA1
a4421180d69c9526038f798c8a57e9e160fb6fd3
-
SHA256
16436b1b6eb9f4649918cec9b716b90ef8a05ad380a3a5777cdde2a53817ebde
-
SHA512
b5881aaa0d7633e4faf8ce0c2e3268462a5a7a4932a8cb0ddf40bf6af008fcd51c3d307d9a0afc11cc06d7d3a60d784a68d26ff7035bdfdf03be9d2f89b883df
-
SSDEEP
196608:V1CJckLYkJq2ANsgY/ArR+muuQhof+8uBW/PCrgu+XpEiBvfH:V1CiQBd3o9J/Eo2VIX0+pEmXH
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 3468 16436b1b6eb9f4649918cec9b716b90ef8a05ad380a3a5777cdde2a53817ebde.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3468 16436b1b6eb9f4649918cec9b716b90ef8a05ad380a3a5777cdde2a53817ebde.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\16436b1b6eb9f4649918cec9b716b90ef8a05ad380a3a5777cdde2a53817ebde.exe"C:\Users\Admin\AppData\Local\Temp\16436b1b6eb9f4649918cec9b716b90ef8a05ad380a3a5777cdde2a53817ebde.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3468