Analysis
-
max time kernel
147s -
max time network
142s -
platform
windows10_x64 -
resource
win10 -
submitted
07/07/2020, 15:21
Static task
static1
Behavioral task
behavioral1
Sample
vv.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
vv.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
vv.exe
-
Size
775KB
-
MD5
7507fa9b94527509a21acb9bfe828508
-
SHA1
05caf17950016f78f93551a87456582778991a07
-
SHA256
2edc612812919760be42de00fde052d6808281cd5009fb6050b21b67cc6db93f
-
SHA512
44569de61755f46c4d3e6b190ab7c2ab426996dd36bb491b53a1b79f92a6f4cc287f2ca9ba790104b641f16770aea3130f6ea5a46cb03c0a23dbf35c83b79b35
Score
5/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2920 wrote to memory of 3736 2920 vv.exe 67 PID 2920 wrote to memory of 3736 2920 vv.exe 67 PID 2920 wrote to memory of 3736 2920 vv.exe 67 PID 2920 wrote to memory of 3736 2920 vv.exe 67 PID 2920 wrote to memory of 3736 2920 vv.exe 67 PID 2920 wrote to memory of 3736 2920 vv.exe 67 PID 2920 wrote to memory of 3736 2920 vv.exe 67 PID 2920 wrote to memory of 3736 2920 vv.exe 67 PID 2992 wrote to memory of 3900 2992 Explorer.EXE 68 PID 2992 wrote to memory of 3900 2992 Explorer.EXE 68 PID 2992 wrote to memory of 3900 2992 Explorer.EXE 68 PID 3900 wrote to memory of 1584 3900 raserver.exe 69 PID 3900 wrote to memory of 1584 3900 raserver.exe 69 PID 3900 wrote to memory of 1584 3900 raserver.exe 69 -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3736 vv.exe Token: SeDebugPrivilege 3900 raserver.exe Token: SeShutdownPrivilege 2992 Explorer.EXE Token: SeCreatePagefilePrivilege 2992 Explorer.EXE Token: SeShutdownPrivilege 2992 Explorer.EXE Token: SeCreatePagefilePrivilege 2992 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 3736 vv.exe 3736 vv.exe 3736 vv.exe 3900 raserver.exe 3900 raserver.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3736 set thread context of 2992 3736 vv.exe 56 PID 3900 set thread context of 2992 3900 raserver.exe 56 -
Suspicious behavior: EnumeratesProcesses 94 IoCs
pid Process 2920 vv.exe 2920 vv.exe 2920 vv.exe 2920 vv.exe 2920 vv.exe 2920 vv.exe 2920 vv.exe 2920 vv.exe 2920 vv.exe 2920 vv.exe 2920 vv.exe 2920 vv.exe 2920 vv.exe 2920 vv.exe 2920 vv.exe 2920 vv.exe 2920 vv.exe 2920 vv.exe 2920 vv.exe 2920 vv.exe 2920 vv.exe 2920 vv.exe 2920 vv.exe 2920 vv.exe 2920 vv.exe 2920 vv.exe 2920 vv.exe 2920 vv.exe 2920 vv.exe 2920 vv.exe 2920 vv.exe 2920 vv.exe 2920 vv.exe 2920 vv.exe 2920 vv.exe 2920 vv.exe 2920 vv.exe 2920 vv.exe 2920 vv.exe 2920 vv.exe 2920 vv.exe 2920 vv.exe 3736 vv.exe 3736 vv.exe 3736 vv.exe 3736 vv.exe 3900 raserver.exe 3900 raserver.exe 3900 raserver.exe 3900 raserver.exe 3900 raserver.exe 3900 raserver.exe 3900 raserver.exe 3900 raserver.exe 3900 raserver.exe 3900 raserver.exe 3900 raserver.exe 3900 raserver.exe 3900 raserver.exe 3900 raserver.exe 3900 raserver.exe 3900 raserver.exe 3900 raserver.exe 3900 raserver.exe 3900 raserver.exe 3900 raserver.exe 3900 raserver.exe 3900 raserver.exe 3900 raserver.exe 3900 raserver.exe 3900 raserver.exe 3900 raserver.exe 3900 raserver.exe 3900 raserver.exe 3900 raserver.exe 3900 raserver.exe 3900 raserver.exe 3900 raserver.exe 3900 raserver.exe 3900 raserver.exe 3900 raserver.exe 3900 raserver.exe 3900 raserver.exe 3900 raserver.exe 3900 raserver.exe 3900 raserver.exe 3900 raserver.exe 3900 raserver.exe 3900 raserver.exe 3900 raserver.exe 3900 raserver.exe 3900 raserver.exe 3900 raserver.exe 3900 raserver.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\vv.exe"C:\Users\Admin\AppData\Local\Temp\vv.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\vv.exe"C:\Users\Admin\AppData\Local\Temp\vv.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:3736
-
-
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:3900 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\vv.exe"3⤵PID:1584
-
-