Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28-01-2025 18:46
Behavioral task
behavioral1
Sample
8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe
-
Size
1.7MB
-
MD5
aa9302592015d61e1fc0a18caf613b4e
-
SHA1
5818301b82b43fd5fa1b851eef474ad370642073
-
SHA256
8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8
-
SHA512
b3794030d5e48a2ca2d62c38680643a20a03907cc887d55502f2f4be01972de883beb3d2f82ed0f7f32bf61ec6ff1f4a6973580881390504b41cc52a3d53c51b
-
SSDEEP
24576:oSuJjPefpdAZuizPWI11u8ab9ILFh2J9kc5yOArDSVXT5Xo2cyaq:oSiPeorzPWJ88yuu8XT5X41q
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe Token: SeDebugPrivilege 3044 8dd3c5a0631a6a91b2c3127a1ad3be5f60e4dad1b63df639c798ab8f72991ec8.exe