Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
20-07-2024 09:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe
Resource
win7-20240704-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe
-
Size
543KB
-
MD5
b86a858e1e9b561e1a4c6b6143725b21
-
SHA1
3cef7ac2a7ddcd4b6932afbe9b2a2fd945dc5a70
-
SHA256
24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef
-
SHA512
f3392f38a4f79902a08f2bf35e5a1ae53f3f28a5158a9d93ea417acd67b7027dbe9f5ffe251b54fea31e2d3bc5aa7fdfc84bc7e5609dfc808f185be626f80f4c
-
SSDEEP
6144:OADxMlezAwn/lbLDzwTTreK6Hn/D0aMkqkDh8ykhwRMu8n4u:lDxM00wntbLwiH/3MhkBj
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeDebugPrivilege 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe Token: SeBackupPrivilege 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe Token: SeSecurityPrivilege 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe Token: SeSecurityPrivilege 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe Token: SeSecurityPrivilege 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe Token: SeSecurityPrivilege 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe Token: SeBackupPrivilege 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe Token: SeSecurityPrivilege 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe Token: SeSecurityPrivilege 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe Token: SeSecurityPrivilege 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe Token: SeSecurityPrivilege 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe Token: SeBackupPrivilege 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe Token: SeSecurityPrivilege 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe Token: SeSecurityPrivilege 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe Token: SeSecurityPrivilege 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe Token: SeSecurityPrivilege 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe Token: SeBackupPrivilege 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe Token: SeSecurityPrivilege 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe Token: SeSecurityPrivilege 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe Token: SeSecurityPrivilege 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe Token: SeSecurityPrivilege 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe Token: SeBackupPrivilege 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe Token: SeSecurityPrivilege 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe Token: SeSecurityPrivilege 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe Token: SeSecurityPrivilege 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe Token: SeSecurityPrivilege 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe Token: SeBackupPrivilege 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe Token: SeSecurityPrivilege 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe Token: SeSecurityPrivilege 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe Token: SeSecurityPrivilege 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe Token: SeSecurityPrivilege 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe Token: SeBackupPrivilege 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe Token: SeSecurityPrivilege 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe Token: SeSecurityPrivilege 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe Token: SeSecurityPrivilege 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe Token: SeSecurityPrivilege 3428 24a5a0271fd9c947f5f3854b7383d96f7bd92f9c66288d2053f58a56c89902ef.exe