Analysis
-
max time kernel
77s -
max time network
110s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
08/09/2020, 12:55
General
-
Target
pidor.bmp.bin.exe
-
Size
148KB
-
MD5
a2df9737790cf786fc6ad4804d33544a
-
SHA1
8b3841b26d65483582ce4a96cb2d2bc3ae2924ab
-
SHA256
fb43eec620345d76ee95aaad3e5a28cdc43d644347f5c56da41ea117b72d3623
-
SHA512
0df7d8bfdc7a89193111650a6125edfd4eae384ce6b425b05013bca8eed9e4323f97bc5231a13bbc57393be2b3482dd8a88a49e97624305931d7c2cef5ac2e8f
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
-
Modifies data under HKEY_USERS 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\pidor.bmp.bin.exe"C:\Users\Admin\AppData\Local\Temp\pidor.bmp.bin.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken