Analysis
-
max time kernel
13s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
03/11/2024, 04:07
Behavioral task
behavioral1
Sample
ec097cedce3196b0d88fee67aada45d58875563725f3d800ae44046c69f28830.exe
Resource
win7-20241010-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
ec097cedce3196b0d88fee67aada45d58875563725f3d800ae44046c69f28830.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
ec097cedce3196b0d88fee67aada45d58875563725f3d800ae44046c69f28830.exe
-
Size
5.3MB
-
MD5
e5376fb19feb91aed1be3b64fbf9474f
-
SHA1
49fb5eb48026cf6fcefbf849dd189f9accd28b57
-
SHA256
ec097cedce3196b0d88fee67aada45d58875563725f3d800ae44046c69f28830
-
SHA512
06d8caf8d734b73d5bc10a737aba0966cc0cb94707ca4a41b4a6ae8907ab938e3525fa3d0f9b912d6ad4ac5eb65a745c032834bd26108e49d1044690c10dbbf8
-
SSDEEP
49152:e9nKaFlFsgFp7HHG4nopAA6LCWQ896519o47RRM/1QDQTAN9WzgRjCGYXZZgfZ7g:paT1Rmzm/TtgjCppZEKl
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2832 wmic.exe Token: SeSecurityPrivilege 2832 wmic.exe Token: SeTakeOwnershipPrivilege 2832 wmic.exe Token: SeLoadDriverPrivilege 2832 wmic.exe Token: SeSystemProfilePrivilege 2832 wmic.exe Token: SeSystemtimePrivilege 2832 wmic.exe Token: SeProfSingleProcessPrivilege 2832 wmic.exe Token: SeIncBasePriorityPrivilege 2832 wmic.exe Token: SeCreatePagefilePrivilege 2832 wmic.exe Token: SeBackupPrivilege 2832 wmic.exe Token: SeRestorePrivilege 2832 wmic.exe Token: SeShutdownPrivilege 2832 wmic.exe Token: SeDebugPrivilege 2832 wmic.exe Token: SeSystemEnvironmentPrivilege 2832 wmic.exe Token: SeRemoteShutdownPrivilege 2832 wmic.exe Token: SeUndockPrivilege 2832 wmic.exe Token: SeManageVolumePrivilege 2832 wmic.exe Token: 33 2832 wmic.exe Token: 34 2832 wmic.exe Token: 35 2832 wmic.exe Token: SeIncreaseQuotaPrivilege 2832 wmic.exe Token: SeSecurityPrivilege 2832 wmic.exe Token: SeTakeOwnershipPrivilege 2832 wmic.exe Token: SeLoadDriverPrivilege 2832 wmic.exe Token: SeSystemProfilePrivilege 2832 wmic.exe Token: SeSystemtimePrivilege 2832 wmic.exe Token: SeProfSingleProcessPrivilege 2832 wmic.exe Token: SeIncBasePriorityPrivilege 2832 wmic.exe Token: SeCreatePagefilePrivilege 2832 wmic.exe Token: SeBackupPrivilege 2832 wmic.exe Token: SeRestorePrivilege 2832 wmic.exe Token: SeShutdownPrivilege 2832 wmic.exe Token: SeDebugPrivilege 2832 wmic.exe Token: SeSystemEnvironmentPrivilege 2832 wmic.exe Token: SeRemoteShutdownPrivilege 2832 wmic.exe Token: SeUndockPrivilege 2832 wmic.exe Token: SeManageVolumePrivilege 2832 wmic.exe Token: 33 2832 wmic.exe Token: 34 2832 wmic.exe Token: 35 2832 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2124 wrote to memory of 2832 2124 ec097cedce3196b0d88fee67aada45d58875563725f3d800ae44046c69f28830.exe 31 PID 2124 wrote to memory of 2832 2124 ec097cedce3196b0d88fee67aada45d58875563725f3d800ae44046c69f28830.exe 31 PID 2124 wrote to memory of 2832 2124 ec097cedce3196b0d88fee67aada45d58875563725f3d800ae44046c69f28830.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec097cedce3196b0d88fee67aada45d58875563725f3d800ae44046c69f28830.exe"C:\Users\Admin\AppData\Local\Temp\ec097cedce3196b0d88fee67aada45d58875563725f3d800ae44046c69f28830.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\system32\wbem\wmic.exewmic os get oslanguage /FORMAT:LIST2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2832
-