Analysis
- max time kernel
148s - max time network
31s - platform
windows7_x64 - resource
win7v200430 - submitted
19/07/2020, 09:42
Static task
static1
Behavioral task
behavioral1
Sample
hen.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
hen.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target hen.exe
- Size 467KB
- Sample200719-wset35bkle
- SHA256 5d8b65f8c8dbafc49e02925b7caee33bf456f0aa396c5dabaf526578ff4a6a5c
- MD5 bb998dd32f512428403a4cbae8a77b3b
- SHA1 8bc890f94a5a3bfa35018a25bcad49c43968758b
- SHA512 f4e42b19539768d1e27f7fb2b5434118d078865e4163ac9c0997b04a571da8483eb6630122a300db914ef9ad591071a5e237d8a6c06b647681aadf2de30aa09e
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
- Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1860 hen.exe 1860 hen.exe 1860 hen.exe 1888 cmmon32.exe 1888 cmmon32.exe - Deletes itself 1 IoCs
pid Process 1752 cmd.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1320 Explorer.EXE 1320 Explorer.EXE 1320 Explorer.EXE 1320 Explorer.EXE - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1320 Explorer.EXE 1320 Explorer.EXE 1320 Explorer.EXE 1320 Explorer.EXE - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1032 hen.exe Token: SeDebugPrivilege 1860 hen.exe Token: SeDebugPrivilege 1888 cmmon32.exe - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 1032 hen.exe 1032 hen.exe 1032 hen.exe 1860 hen.exe 1860 hen.exe 1888 cmmon32.exe 1888 cmmon32.exe 1888 cmmon32.exe 1888 cmmon32.exe 1888 cmmon32.exe 1888 cmmon32.exe 1888 cmmon32.exe 1888 cmmon32.exe 1888 cmmon32.exe 1888 cmmon32.exe 1888 cmmon32.exe 1888 cmmon32.exe 1888 cmmon32.exe 1888 cmmon32.exe 1888 cmmon32.exe 1888 cmmon32.exe 1888 cmmon32.exe 1888 cmmon32.exe 1888 cmmon32.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1032 wrote to memory of 1860 1032 hen.exe 26 PID 1032 wrote to memory of 1860 1032 hen.exe 26 PID 1032 wrote to memory of 1860 1032 hen.exe 26 PID 1032 wrote to memory of 1860 1032 hen.exe 26 PID 1032 wrote to memory of 1860 1032 hen.exe 26 PID 1032 wrote to memory of 1860 1032 hen.exe 26 PID 1032 wrote to memory of 1860 1032 hen.exe 26 PID 1320 wrote to memory of 1888 1320 Explorer.EXE 27 PID 1320 wrote to memory of 1888 1320 Explorer.EXE 27 PID 1320 wrote to memory of 1888 1320 Explorer.EXE 27 PID 1320 wrote to memory of 1888 1320 Explorer.EXE 27 PID 1888 wrote to memory of 1752 1888 cmmon32.exe 28 PID 1888 wrote to memory of 1752 1888 cmmon32.exe 28 PID 1888 wrote to memory of 1752 1888 cmmon32.exe 28 PID 1888 wrote to memory of 1752 1888 cmmon32.exe 28 - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1032 set thread context of 1860 1032 hen.exe 26 PID 1860 set thread context of 1320 1860 hen.exe 20 PID 1888 set thread context of 1320 1888 cmmon32.exe 20
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\hen.exe"C:\Users\Admin\AppData\Local\Temp\hen.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\hen.exe"C:\Users\Admin\AppData\Local\Temp\hen.exe"3⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
PID:1860
-
-
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1888 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\hen.exe"3⤵
- Deletes itself
PID:1752
-
-