Analysis
-
max time kernel
141s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
28/03/2025, 19:03
Behavioral task
behavioral1
Sample
4518bf495714b43395011e7f87aae2afc12905492b514e06f8c1dfd6d7774ab0.exe
Resource
win7-20250207-en
Behavioral task
behavioral2
Sample
4518bf495714b43395011e7f87aae2afc12905492b514e06f8c1dfd6d7774ab0.exe
Resource
win10v2004-20250314-en
General
-
Target
4518bf495714b43395011e7f87aae2afc12905492b514e06f8c1dfd6d7774ab0.exe
-
Size
9.7MB
-
MD5
c9cb2c8969c1f10535557afe48f67981
-
SHA1
012a5eae54d3c5333c1cc0e35ab9d9f0c802848c
-
SHA256
4518bf495714b43395011e7f87aae2afc12905492b514e06f8c1dfd6d7774ab0
-
SHA512
0f4ebbbd5dae93b133acac12a5a5eaf5b63beef3bce5c4212f7d86bdb4b986e58c01cb14154ee431041b7373cf7957f9549aa256bac5bc73516651fd830a22eb
-
SSDEEP
98304:pFhU4fZgQrxMTHjXZ7tBxU6XAXNTN/ZWWeYZLfyBlZw4+xKC0g4c5yvq8B1zLSJ5:JUI1hPLyz1SJtGew8ncCEGmK6pfL7Kbl
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 436 4518bf495714b43395011e7f87aae2afc12905492b514e06f8c1dfd6d7774ab0.exe Token: SeLockMemoryPrivilege 436 4518bf495714b43395011e7f87aae2afc12905492b514e06f8c1dfd6d7774ab0.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 436 4518bf495714b43395011e7f87aae2afc12905492b514e06f8c1dfd6d7774ab0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4518bf495714b43395011e7f87aae2afc12905492b514e06f8c1dfd6d7774ab0.exe"C:\Users\Admin\AppData\Local\Temp\4518bf495714b43395011e7f87aae2afc12905492b514e06f8c1dfd6d7774ab0.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:436