Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21/11/2024, 09:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe
-
Size
5.0MB
-
MD5
f7c96ff131b356fe164c8d666c0f3b46
-
SHA1
7468349a73f810bcf320dd6ae65cb46fc81a9c10
-
SHA256
fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876
-
SHA512
3ed0e90e947e80af53b74b0e6fbaca4ba4de5005eb066d6a975fc3455320b6e48a8fca7858916769ab1f38143e8a3a63f1452d5568fe5d3728d04e80f583d470
-
SSDEEP
98304:Br7X73KcrCU3KoRdqPU4RRXuDuDRRXuDuQ:B/j0ounXuDKnXuDz
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Ã÷¸ç = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe" fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe -
Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeDebugPrivilege 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: 1 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: SeCreateTokenPrivilege 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: SeAssignPrimaryTokenPrivilege 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: SeLockMemoryPrivilege 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: SeIncreaseQuotaPrivilege 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: SeMachineAccountPrivilege 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: SeTcbPrivilege 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: SeSecurityPrivilege 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: SeTakeOwnershipPrivilege 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: SeLoadDriverPrivilege 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: SeSystemProfilePrivilege 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: SeSystemtimePrivilege 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: SeProfSingleProcessPrivilege 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: SeIncBasePriorityPrivilege 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: SeCreatePagefilePrivilege 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: SeCreatePermanentPrivilege 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: SeBackupPrivilege 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: SeRestorePrivilege 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: SeShutdownPrivilege 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: SeDebugPrivilege 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: SeAuditPrivilege 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: SeSystemEnvironmentPrivilege 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: SeChangeNotifyPrivilege 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: SeRemoteShutdownPrivilege 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: SeUndockPrivilege 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: SeSyncAgentPrivilege 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: SeEnableDelegationPrivilege 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: SeManageVolumePrivilege 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: SeImpersonatePrivilege 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: SeCreateGlobalPrivilege 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: 31 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: 32 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: 33 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: 34 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: 35 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: 36 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: 37 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: 38 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: 39 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: 40 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: 41 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: 42 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: 43 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: 44 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: 45 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: 46 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: 47 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe Token: 48 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe 2356 fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe"C:\Users\Admin\AppData\Local\Temp\fb2812b22e399ad46d1c3da512199be1647ad932dd5c0166d58be87cde3e1876.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2356