Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28-01-2025 14:46
Behavioral task
behavioral1
Sample
5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe
-
Size
1.4MB
-
MD5
84c593cd77d1515aeee6485286d9a906
-
SHA1
61f504a736801048f833932cbed4f96d8fcb7ec3
-
SHA256
5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca
-
SHA512
fe82cc7d5b791b7812052223b9adf10b6e5311e35114eb11b7d2f1a513764a725c050938ca2038bde2a817239f149a95ae5679980f60cffa5b17bc40c756531f
-
SSDEEP
24576:zS2r2fUlJc3K9h1d4jWUzrq4xQkQvwZHbJ7Bx4ZDSgsoiE:08o3ehLq5rq4fQvwNV774biE
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2068 5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe"C:\Users\Admin\AppData\Local\Temp\5060007413ed16010796d68fd8cea049d3c0bfb3f79f03c81bae6f78616512ca.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2068