Analysis
- max time kernel
149s - max time network
58s - platform
windows10_x64 - resource
win10v200430 - submitted
24/06/2020, 13:14
Static task
static1
Behavioral task
behavioral1
Sample
copy #24445.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
copy #24445.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target copy #24445.exe
- Size 335KB
- Sample200624-zedma36dgx
- SHA256 8f684309eb4b620c8b81b30aa2d1b8f09d3f8e3dd69dadfb69f7b6db8e1bb1e3
- MD5 6230f83f0a3f26287897f759daf0f00f
- SHA1 e00876c2a2278aee3aaa73244ade6b239e3d5fff
- SHA512 18480936dc9e57720b19991bebc5f53ac0107a808ca873c3d15c1b109a029e65118a4f23efc9c3ef58a26806bf49f922bbe71e48943054f2aa488b9e1bddc18e
- MD5 SHA1 SHA512
Score
5/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 2156 copy #24445.exe Token: SeShutdownPrivilege 3044 Explorer.EXE Token: SeCreatePagefilePrivilege 3044 Explorer.EXE Token: SeDebugPrivilege 2480 help.exe Token: SeShutdownPrivilege 3044 Explorer.EXE Token: SeCreatePagefilePrivilege 3044 Explorer.EXE Token: SeShutdownPrivilege 3044 Explorer.EXE Token: SeCreatePagefilePrivilege 3044 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2156 copy #24445.exe 2156 copy #24445.exe 2156 copy #24445.exe 2480 help.exe 2480 help.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4004 wrote to memory of 2156 4004 copy #24445.exe 72 PID 4004 wrote to memory of 2156 4004 copy #24445.exe 72 PID 4004 wrote to memory of 2156 4004 copy #24445.exe 72 PID 4004 wrote to memory of 2156 4004 copy #24445.exe 72 PID 4004 wrote to memory of 2156 4004 copy #24445.exe 72 PID 4004 wrote to memory of 2156 4004 copy #24445.exe 72 PID 3044 wrote to memory of 2480 3044 Explorer.EXE 73 PID 3044 wrote to memory of 2480 3044 Explorer.EXE 73 PID 3044 wrote to memory of 2480 3044 Explorer.EXE 73 PID 2480 wrote to memory of 2816 2480 help.exe 74 PID 2480 wrote to memory of 2816 2480 help.exe 74 PID 2480 wrote to memory of 2816 2480 help.exe 74 - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4004 set thread context of 2156 4004 copy #24445.exe 72 PID 2156 set thread context of 3044 2156 copy #24445.exe 56 PID 2480 set thread context of 3044 2480 help.exe 56 - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 2156 copy #24445.exe 2156 copy #24445.exe 2156 copy #24445.exe 2156 copy #24445.exe 2480 help.exe 2480 help.exe 2480 help.exe 2480 help.exe 2480 help.exe 2480 help.exe 2480 help.exe 2480 help.exe 2480 help.exe 2480 help.exe 2480 help.exe 2480 help.exe 2480 help.exe 2480 help.exe 2480 help.exe 2480 help.exe 2480 help.exe 2480 help.exe 2480 help.exe 2480 help.exe 2480 help.exe 2480 help.exe 2480 help.exe 2480 help.exe 2480 help.exe 2480 help.exe 2480 help.exe 2480 help.exe 2480 help.exe 2480 help.exe 2480 help.exe 2480 help.exe 2480 help.exe 2480 help.exe 2480 help.exe 2480 help.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\copy #24445.exe"C:\Users\Admin\AppData\Local\Temp\copy #24445.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\copy #24445.exe"{path}"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:2156
-
-
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:2480 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\copy #24445.exe"3⤵PID:2816
-
-