Analysis
-
max time kernel
152s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
08-02-2025 07:06
Behavioral task
behavioral1
Sample
524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe
Resource
win7-20241010-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe
Resource
win10v2004-20250207-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe
-
Size
2.0MB
-
MD5
72bb3ebab25484319d50eb5156a58ba9
-
SHA1
872ddb0a323f630e1814e9b4421f0a9e43d886d7
-
SHA256
524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101
-
SHA512
0884681728978fe3058809b65e67bbb1e0e613ff688155f77a555f321c6808250f21c0144cabe7c7c525558347f42ac8bce1336d118619f9b1c3e767e25acfa3
-
SSDEEP
49152:AVImnP3ObryxvZcaS39o1LsWO4iaXT5XeM1E:A8OOaS36D5r1E
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe Token: SeDebugPrivilege 2892 524fffde0ef5f3f80ae20ec0c60db954f9938c6ee89953dc78f21953479df101.exe