Analysis
- max time kernel
148s - max time network
126s - platform
windows7_x64 - resource
win7 - submitted
24/06/2020, 14:58
Static task
static1
Behavioral task
behavioral1
Sample
PI 46788393.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
PI 46788393.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target PI 46788393.exe
- Size 530KB
- Sample200624-hl3aggase6
- SHA256 773fbca16ec67d4820654e39aaa65645f8608a8f7186f12b5ed62498ff1334c6
- MD5 1365ef23d6453fbc22a28ee56bec858b
- SHA1 c3f1def4b65bc427e791d2e285beadf5b0dfc654
- SHA512 35aff0f520f713c53420644f3fb92e6037614691934939781299e1350dd290b92ed4c7d1b8e7aa4ac164b9d1ffbde98838740e0ec4ce2798b93b45d44c2b6592
- MD5 SHA1 SHA512
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 1912 cmd.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 900 set thread context of 1848 900 PI 46788393.exe 26 PID 1848 set thread context of 1268 1848 PI 46788393.exe 20 PID 1888 set thread context of 1268 1888 cscript.exe 20 - Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 1848 PI 46788393.exe 1848 PI 46788393.exe 1888 cscript.exe 1888 cscript.exe 1888 cscript.exe 1888 cscript.exe 1888 cscript.exe 1888 cscript.exe 1888 cscript.exe 1888 cscript.exe 1888 cscript.exe 1888 cscript.exe 1888 cscript.exe 1888 cscript.exe 1888 cscript.exe 1888 cscript.exe 1888 cscript.exe 1888 cscript.exe 1888 cscript.exe 1888 cscript.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1848 PI 46788393.exe Token: SeDebugPrivilege 1888 cscript.exe - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 900 wrote to memory of 1848 900 PI 46788393.exe 26 PID 900 wrote to memory of 1848 900 PI 46788393.exe 26 PID 900 wrote to memory of 1848 900 PI 46788393.exe 26 PID 900 wrote to memory of 1848 900 PI 46788393.exe 26 PID 900 wrote to memory of 1848 900 PI 46788393.exe 26 PID 900 wrote to memory of 1848 900 PI 46788393.exe 26 PID 900 wrote to memory of 1848 900 PI 46788393.exe 26 PID 1268 wrote to memory of 1888 1268 Explorer.EXE 27 PID 1268 wrote to memory of 1888 1268 Explorer.EXE 27 PID 1268 wrote to memory of 1888 1268 Explorer.EXE 27 PID 1268 wrote to memory of 1888 1268 Explorer.EXE 27 PID 1888 wrote to memory of 1912 1888 cscript.exe 28 PID 1888 wrote to memory of 1912 1888 cscript.exe 28 PID 1888 wrote to memory of 1912 1888 cscript.exe 28 PID 1888 wrote to memory of 1912 1888 cscript.exe 28 - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1848 PI 46788393.exe 1848 PI 46788393.exe 1848 PI 46788393.exe 1888 cscript.exe 1888 cscript.exe - Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Checks whether UAC is enabled
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- Suspicious use of FindShellTrayWindow
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\PI 46788393.exe"C:\Users\Admin\AppData\Local\Temp\PI 46788393.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Users\Admin\AppData\Local\Temp\PI 46788393.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
PID:1848
-
-
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
PID:1888 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PI 46788393.exe"3⤵
- Deletes itself
PID:1912
-
-