Analysis
- max time kernel
151s - max time network
70s - platform
windows10_x64 - resource
win10v200430 - submitted
24/06/2020, 14:58
Static task
static1
Behavioral task
behavioral1
Sample
PI 46788393.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
PI 46788393.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target PI 46788393.exe
- Size 530KB
- Sample200624-hl3aggase6
- SHA256 773fbca16ec67d4820654e39aaa65645f8608a8f7186f12b5ed62498ff1334c6
- MD5 1365ef23d6453fbc22a28ee56bec858b
- SHA1 c3f1def4b65bc427e791d2e285beadf5b0dfc654
- SHA512 35aff0f520f713c53420644f3fb92e6037614691934939781299e1350dd290b92ed4c7d1b8e7aa4ac164b9d1ffbde98838740e0ec4ce2798b93b45d44c2b6592
- MD5 SHA1 SHA512
Score
5/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2704 PI 46788393.exe Token: SeDebugPrivilege 3744 colorcpl.exe - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2704 PI 46788393.exe 2704 PI 46788393.exe 2704 PI 46788393.exe 3744 colorcpl.exe 3744 colorcpl.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2916 wrote to memory of 2704 2916 PI 46788393.exe 72 PID 2916 wrote to memory of 2704 2916 PI 46788393.exe 72 PID 2916 wrote to memory of 2704 2916 PI 46788393.exe 72 PID 2916 wrote to memory of 2704 2916 PI 46788393.exe 72 PID 2916 wrote to memory of 2704 2916 PI 46788393.exe 72 PID 2916 wrote to memory of 2704 2916 PI 46788393.exe 72 PID 2988 wrote to memory of 3744 2988 Explorer.EXE 75 PID 2988 wrote to memory of 3744 2988 Explorer.EXE 75 PID 2988 wrote to memory of 3744 2988 Explorer.EXE 75 PID 3744 wrote to memory of 3888 3744 colorcpl.exe 76 PID 3744 wrote to memory of 3888 3744 colorcpl.exe 76 PID 3744 wrote to memory of 3888 3744 colorcpl.exe 76 - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2916 set thread context of 2704 2916 PI 46788393.exe 72 PID 2704 set thread context of 2988 2704 PI 46788393.exe 56 PID 3744 set thread context of 2988 3744 colorcpl.exe 56 - Suspicious behavior: EnumeratesProcesses 36 IoCs
pid Process 2704 PI 46788393.exe 2704 PI 46788393.exe 2704 PI 46788393.exe 2704 PI 46788393.exe 3744 colorcpl.exe 3744 colorcpl.exe 3744 colorcpl.exe 3744 colorcpl.exe 3744 colorcpl.exe 3744 colorcpl.exe 3744 colorcpl.exe 3744 colorcpl.exe 3744 colorcpl.exe 3744 colorcpl.exe 3744 colorcpl.exe 3744 colorcpl.exe 3744 colorcpl.exe 3744 colorcpl.exe 3744 colorcpl.exe 3744 colorcpl.exe 3744 colorcpl.exe 3744 colorcpl.exe 3744 colorcpl.exe 3744 colorcpl.exe 3744 colorcpl.exe 3744 colorcpl.exe 3744 colorcpl.exe 3744 colorcpl.exe 3744 colorcpl.exe 3744 colorcpl.exe 3744 colorcpl.exe 3744 colorcpl.exe 3744 colorcpl.exe 3744 colorcpl.exe 3744 colorcpl.exe 3744 colorcpl.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\PI 46788393.exe"C:\Users\Admin\AppData\Local\Temp\PI 46788393.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\PI 46788393.exe"{path}"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:2704
-
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:2856
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:2996
-
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:3744 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PI 46788393.exe"3⤵PID:3888
-
-