Analysis
- max time kernel
148s - max time network
83s - platform
windows7_x64 - resource
win7v200722 - submitted
22/07/2020, 15:15
Static task
static1
Behavioral task
behavioral1
Sample
002.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
002.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
- Target 002.exe
- Size 387KB
- Sample200722-s18bcv48k2
- SHA256 f626ac44e4d6711e2b2a128fbde9bebf2a8b7c66d7161376993d3252c16dd083
- MD5 5e024d6bcc07e3ee550a8d303d26137d
- SHA1 9986548c9971388c87b20e87f72d739fbed47e87
- SHA512 7984643155e20315be78a6075edd06d9b280b1d49986b3e805990da488f697a8a5c1196d1abb690eb43beaab3009a4ecc6940d88a7c02a42648796e7d2b8339d
- MD5 SHA1 SHA512
Score
5/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 1680 002.exe 1980 RegSvcs.exe 1980 RegSvcs.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1680 set thread context of 1980 1680 002.exe 27 PID 1980 set thread context of 1212 1980 RegSvcs.exe 20 PID 1848 set thread context of 1212 1848 rundll32.exe 20 - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1980 RegSvcs.exe 1980 RegSvcs.exe 1980 RegSvcs.exe 1848 rundll32.exe 1848 rundll32.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1680 wrote to memory of 1964 1680 002.exe 26 PID 1680 wrote to memory of 1964 1680 002.exe 26 PID 1680 wrote to memory of 1964 1680 002.exe 26 PID 1680 wrote to memory of 1964 1680 002.exe 26 PID 1680 wrote to memory of 1964 1680 002.exe 26 PID 1680 wrote to memory of 1964 1680 002.exe 26 PID 1680 wrote to memory of 1964 1680 002.exe 26 PID 1680 wrote to memory of 1980 1680 002.exe 27 PID 1680 wrote to memory of 1980 1680 002.exe 27 PID 1680 wrote to memory of 1980 1680 002.exe 27 PID 1680 wrote to memory of 1980 1680 002.exe 27 PID 1680 wrote to memory of 1980 1680 002.exe 27 PID 1680 wrote to memory of 1980 1680 002.exe 27 PID 1680 wrote to memory of 1980 1680 002.exe 27 PID 1680 wrote to memory of 1980 1680 002.exe 27 PID 1680 wrote to memory of 1980 1680 002.exe 27 PID 1680 wrote to memory of 1980 1680 002.exe 27 PID 1212 wrote to memory of 1848 1212 Explorer.EXE 28 PID 1212 wrote to memory of 1848 1212 Explorer.EXE 28 PID 1212 wrote to memory of 1848 1212 Explorer.EXE 28 PID 1212 wrote to memory of 1848 1212 Explorer.EXE 28 PID 1212 wrote to memory of 1848 1212 Explorer.EXE 28 PID 1212 wrote to memory of 1848 1212 Explorer.EXE 28 PID 1212 wrote to memory of 1848 1212 Explorer.EXE 28 PID 1848 wrote to memory of 520 1848 rundll32.exe 29 PID 1848 wrote to memory of 520 1848 rundll32.exe 29 PID 1848 wrote to memory of 520 1848 rundll32.exe 29 PID 1848 wrote to memory of 520 1848 rundll32.exe 29 - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1680 002.exe Token: SeDebugPrivilege 1980 RegSvcs.exe Token: SeDebugPrivilege 1848 rundll32.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\002.exe"C:\Users\Admin\AppData\Local\Temp\002.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:1680 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"3⤵PID:1964
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1980
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:1848 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:520
-
-