Analysis
-
max time kernel
134s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
03-11-2024 04:07
Behavioral task
behavioral1
Sample
ec097cedce3196b0d88fee67aada45d58875563725f3d800ae44046c69f28830.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral2
Sample
ec097cedce3196b0d88fee67aada45d58875563725f3d800ae44046c69f28830.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
ec097cedce3196b0d88fee67aada45d58875563725f3d800ae44046c69f28830.exe
-
Size
5.3MB
-
MD5
e5376fb19feb91aed1be3b64fbf9474f
-
SHA1
49fb5eb48026cf6fcefbf849dd189f9accd28b57
-
SHA256
ec097cedce3196b0d88fee67aada45d58875563725f3d800ae44046c69f28830
-
SHA512
06d8caf8d734b73d5bc10a737aba0966cc0cb94707ca4a41b4a6ae8907ab938e3525fa3d0f9b912d6ad4ac5eb65a745c032834bd26108e49d1044690c10dbbf8
-
SSDEEP
49152:e9nKaFlFsgFp7HHG4nopAA6LCWQ896519o47RRM/1QDQTAN9WzgRjCGYXZZgfZ7g:paT1Rmzm/TtgjCppZEKl
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
Processes:
wmic.exedescription pid Process Token: SeIncreaseQuotaPrivilege 216 wmic.exe Token: SeSecurityPrivilege 216 wmic.exe Token: SeTakeOwnershipPrivilege 216 wmic.exe Token: SeLoadDriverPrivilege 216 wmic.exe Token: SeSystemProfilePrivilege 216 wmic.exe Token: SeSystemtimePrivilege 216 wmic.exe Token: SeProfSingleProcessPrivilege 216 wmic.exe Token: SeIncBasePriorityPrivilege 216 wmic.exe Token: SeCreatePagefilePrivilege 216 wmic.exe Token: SeBackupPrivilege 216 wmic.exe Token: SeRestorePrivilege 216 wmic.exe Token: SeShutdownPrivilege 216 wmic.exe Token: SeDebugPrivilege 216 wmic.exe Token: SeSystemEnvironmentPrivilege 216 wmic.exe Token: SeRemoteShutdownPrivilege 216 wmic.exe Token: SeUndockPrivilege 216 wmic.exe Token: SeManageVolumePrivilege 216 wmic.exe Token: 33 216 wmic.exe Token: 34 216 wmic.exe Token: 35 216 wmic.exe Token: 36 216 wmic.exe Token: SeIncreaseQuotaPrivilege 216 wmic.exe Token: SeSecurityPrivilege 216 wmic.exe Token: SeTakeOwnershipPrivilege 216 wmic.exe Token: SeLoadDriverPrivilege 216 wmic.exe Token: SeSystemProfilePrivilege 216 wmic.exe Token: SeSystemtimePrivilege 216 wmic.exe Token: SeProfSingleProcessPrivilege 216 wmic.exe Token: SeIncBasePriorityPrivilege 216 wmic.exe Token: SeCreatePagefilePrivilege 216 wmic.exe Token: SeBackupPrivilege 216 wmic.exe Token: SeRestorePrivilege 216 wmic.exe Token: SeShutdownPrivilege 216 wmic.exe Token: SeDebugPrivilege 216 wmic.exe Token: SeSystemEnvironmentPrivilege 216 wmic.exe Token: SeRemoteShutdownPrivilege 216 wmic.exe Token: SeUndockPrivilege 216 wmic.exe Token: SeManageVolumePrivilege 216 wmic.exe Token: 33 216 wmic.exe Token: 34 216 wmic.exe Token: 35 216 wmic.exe Token: 36 216 wmic.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
ec097cedce3196b0d88fee67aada45d58875563725f3d800ae44046c69f28830.exedescription pid Process procid_target PID 3332 wrote to memory of 216 3332 ec097cedce3196b0d88fee67aada45d58875563725f3d800ae44046c69f28830.exe 85 PID 3332 wrote to memory of 216 3332 ec097cedce3196b0d88fee67aada45d58875563725f3d800ae44046c69f28830.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec097cedce3196b0d88fee67aada45d58875563725f3d800ae44046c69f28830.exe"C:\Users\Admin\AppData\Local\Temp\ec097cedce3196b0d88fee67aada45d58875563725f3d800ae44046c69f28830.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Windows\system32\wbem\wmic.exewmic os get oslanguage /FORMAT:LIST2⤵
- Suspicious use of AdjustPrivilegeToken
PID:216
-