Analysis
- max time kernel
121s - max time network
123s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
03/07/2024, 09:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
068ef78225ab94c3f9c228d6248911986c23317d269f0bb5d0a46bd15cd93e80.exe
Resource
win7-20240221-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
068ef78225ab94c3f9c228d6248911986c23317d269f0bb5d0a46bd15cd93e80.exe
Resource
win10v2004-20240611-en
4 signatures
150 seconds
General
- Target 068ef78225ab94c3f9c228d6248911986c23317d269f0bb5d0a46bd15cd93e80.exe
- Size 1.2MB
- Sample240703-k155rawanb
- SHA256 068ef78225ab94c3f9c228d6248911986c23317d269f0bb5d0a46bd15cd93e80
- MD5 5cc421c63500bf1b86a6ca91ba3ff59d
- SHA1 aabc165f59fa0ff48f1e43a25aadf7d1b6f9be33
- SHA512 f44eb23c99a69309c7474371f95412b4d7f0ed753f325bb6361789e13ded199e3787615ceaed11ab34f37dc47bfa9b18466f6bbe14da9a19496fd8443327e9aa
- SSDEEP 24576:CZFIW9d25anjboPJz7fminWVHeXj69KtyBZnIG61M4nftgHJ2H8/:CByPmO+HeXj60W664ftgIc
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2044 068ef78225ab94c3f9c228d6248911986c23317d269f0bb5d0a46bd15cd93e80.exe 2044 068ef78225ab94c3f9c228d6248911986c23317d269f0bb5d0a46bd15cd93e80.exe 2044 068ef78225ab94c3f9c228d6248911986c23317d269f0bb5d0a46bd15cd93e80.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 2044 068ef78225ab94c3f9c228d6248911986c23317d269f0bb5d0a46bd15cd93e80.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\068ef78225ab94c3f9c228d6248911986c23317d269f0bb5d0a46bd15cd93e80.exe"C:\Users\Admin\AppData\Local\Temp\068ef78225ab94c3f9c228d6248911986c23317d269f0bb5d0a46bd15cd93e80.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2044