Analysis
- max time kernel
145s - max time network
69s - platform
windows10_x64 - resource
win10v200430 - submitted
16/07/2020, 19:07
Static task
static1
Behavioral task
behavioral1
Sample
00 ALLENBERRY SPECS &REQUIR....exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
00 ALLENBERRY SPECS &REQUIR....exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target 00 ALLENBERRY SPECS &REQUIR....exe
- Size 326KB
- Sample200716-jay8dhrb4n
- SHA256 f69e7749b6798b4c4f258eebbedc77992536cc24bef9d1bf3d68315ad16abcf0
- MD5 a11eb73c63a29366d021ecdb1a6622b7
- SHA1 876771c4074786daab4e4bd5f4ab7b2c2d3705f2
- SHA512 e832690fa933ff4b0ee9d043a449b7086a0e7af441a96320601e9932cee27153bb81198629e8548d72b9147f57bb6b331d6265fd61790e2ac711c282217f3544
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 88 IoCs
description pid Process procid_target PID 428 wrote to memory of 644 428 00 ALLENBERRY SPECS &REQUIR....exe 66 PID 428 wrote to memory of 644 428 00 ALLENBERRY SPECS &REQUIR....exe 66 PID 428 wrote to memory of 644 428 00 ALLENBERRY SPECS &REQUIR....exe 66 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 644 wrote to memory of 816 644 rundll32.exe 67 PID 2980 wrote to memory of 1884 2980 Explorer.EXE 70 PID 2980 wrote to memory of 1884 2980 Explorer.EXE 70 PID 2980 wrote to memory of 1884 2980 Explorer.EXE 70 PID 1884 wrote to memory of 2128 1884 rundll32.exe 72 PID 1884 wrote to memory of 2128 1884 rundll32.exe 72 PID 1884 wrote to memory of 2128 1884 rundll32.exe 72 - Loads dropped DLL 1 IoCs
pid Process 644 rundll32.exe - Suspicious behavior: EnumeratesProcesses 49 IoCs
pid Process 644 rundll32.exe 816 cmd.exe 816 cmd.exe 816 cmd.exe 816 cmd.exe 1884 rundll32.exe 1884 rundll32.exe 1884 rundll32.exe 1884 rundll32.exe 1884 rundll32.exe 1884 rundll32.exe 1884 rundll32.exe 1884 rundll32.exe 1884 rundll32.exe 1884 rundll32.exe 1884 rundll32.exe 1884 rundll32.exe 1884 rundll32.exe 1884 rundll32.exe 1884 rundll32.exe 1884 rundll32.exe 1884 rundll32.exe 1884 rundll32.exe 1884 rundll32.exe 1884 rundll32.exe 1884 rundll32.exe 1884 rundll32.exe 1884 rundll32.exe 1884 rundll32.exe 1884 rundll32.exe 1884 rundll32.exe 1884 rundll32.exe 1884 rundll32.exe 1884 rundll32.exe 1884 rundll32.exe 1884 rundll32.exe 1884 rundll32.exe 1884 rundll32.exe 1884 rundll32.exe 1884 rundll32.exe 1884 rundll32.exe 1884 rundll32.exe 1884 rundll32.exe 1884 rundll32.exe 1884 rundll32.exe 1884 rundll32.exe 1884 rundll32.exe 1884 rundll32.exe 1884 rundll32.exe - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 644 rundll32.exe 816 cmd.exe 816 cmd.exe 816 cmd.exe 1884 rundll32.exe 1884 rundll32.exe - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 816 cmd.exe Token: SeDebugPrivilege 1884 rundll32.exe Token: SeShutdownPrivilege 2980 Explorer.EXE Token: SeCreatePagefilePrivilege 2980 Explorer.EXE Token: SeShutdownPrivilege 2980 Explorer.EXE Token: SeCreatePagefilePrivilege 2980 Explorer.EXE Token: SeShutdownPrivilege 2980 Explorer.EXE Token: SeCreatePagefilePrivilege 2980 Explorer.EXE - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 816 set thread context of 2980 816 cmd.exe 56 PID 1884 set thread context of 2980 1884 rundll32.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\00 ALLENBERRY SPECS &REQUIR....exe"C:\Users\Admin\AppData\Local\Temp\00 ALLENBERRY SPECS &REQUIR....exe"2⤵
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe GuestRummy,Michelle3⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:644 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:816
-
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1884 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\cmd.exe"3⤵PID:2128
-
-