Analysis
- max time kernel
149s - max time network
147s - platform
windows10_x64 - resource
win10 - submitted
01/07/2020, 05:33
Static task
static1
Behavioral task
behavioral1
Sample
#PO##5678543278...COPY.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
#PO##5678543278...COPY.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target #PO##5678543278...COPY.exe
- Size 302KB
- Sample200701-t4yww7crms
- SHA256 430632994b3bcc69911202aa595375009e84accb95b00917bde643fcf031fa4d
- MD5 7a3750d52e2491d0360ec5e3cf5f0b1f
- SHA1 21a8a81928261c01ce481a14d623663eef5bf2ba
- SHA512 099dc4fe67a0ef50459a9f137f41eb78bd6b01cdeec9f8f524fd8476346a132ed4bda5b471e87e5a8be90fbb0ff78d2b7c7d9da25340c2d3d1468d1a46ae1387
- MD5 SHA1 SHA512
Score
5/10
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 772 wrote to memory of 3644 772 #PO##5678543278...COPY.exe 66 PID 772 wrote to memory of 3644 772 #PO##5678543278...COPY.exe 66 PID 772 wrote to memory of 3644 772 #PO##5678543278...COPY.exe 66 PID 772 wrote to memory of 3644 772 #PO##5678543278...COPY.exe 66 PID 772 wrote to memory of 3644 772 #PO##5678543278...COPY.exe 66 PID 772 wrote to memory of 3644 772 #PO##5678543278...COPY.exe 66 PID 2964 wrote to memory of 4056 2964 Explorer.EXE 75 PID 2964 wrote to memory of 4056 2964 Explorer.EXE 75 PID 2964 wrote to memory of 4056 2964 Explorer.EXE 75 PID 4056 wrote to memory of 3916 4056 explorer.exe 76 PID 4056 wrote to memory of 3916 4056 explorer.exe 76 PID 4056 wrote to memory of 3916 4056 explorer.exe 76 - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 772 set thread context of 3644 772 #PO##5678543278...COPY.exe 66 PID 3644 set thread context of 2964 3644 #PO##5678543278...COPY.exe 56 PID 4056 set thread context of 2964 4056 explorer.exe 56 - Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 3644 #PO##5678543278...COPY.exe 3644 #PO##5678543278...COPY.exe 3644 #PO##5678543278...COPY.exe 3644 #PO##5678543278...COPY.exe 4056 explorer.exe 4056 explorer.exe 4056 explorer.exe 4056 explorer.exe 4056 explorer.exe 4056 explorer.exe 4056 explorer.exe 4056 explorer.exe 4056 explorer.exe 4056 explorer.exe 4056 explorer.exe 4056 explorer.exe 4056 explorer.exe 4056 explorer.exe 4056 explorer.exe 4056 explorer.exe 4056 explorer.exe 4056 explorer.exe 4056 explorer.exe 4056 explorer.exe 4056 explorer.exe 4056 explorer.exe 4056 explorer.exe 4056 explorer.exe 4056 explorer.exe 4056 explorer.exe 4056 explorer.exe 4056 explorer.exe 4056 explorer.exe 4056 explorer.exe 4056 explorer.exe 4056 explorer.exe 4056 explorer.exe 4056 explorer.exe 4056 explorer.exe 4056 explorer.exe 4056 explorer.exe 4056 explorer.exe 4056 explorer.exe 4056 explorer.exe 4056 explorer.exe 4056 explorer.exe 4056 explorer.exe 4056 explorer.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3644 #PO##5678543278...COPY.exe Token: SeDebugPrivilege 4056 explorer.exe Token: SeShutdownPrivilege 2964 Explorer.EXE Token: SeCreatePagefilePrivilege 2964 Explorer.EXE Token: SeShutdownPrivilege 2964 Explorer.EXE Token: SeCreatePagefilePrivilege 2964 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 3644 #PO##5678543278...COPY.exe 3644 #PO##5678543278...COPY.exe 3644 #PO##5678543278...COPY.exe 4056 explorer.exe 4056 explorer.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\#PO##5678543278...COPY.exe"C:\Users\Admin\AppData\Local\Temp\#PO##5678543278...COPY.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:772 -
C:\Users\Admin\AppData\Local\Temp\#PO##5678543278...COPY.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
PID:3644
-
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:3004
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:4036
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:1392
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:3600
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:3856
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:1464
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:3220
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:3844
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
PID:4056 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\#PO##5678543278...COPY.exe"3⤵PID:3916
-
-