Analysis
-
max time kernel
134s -
max time network
137s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
09-11-2020 19:36
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Variant.Zusy.302928.14908.28795.exe
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Variant.Zusy.302928.14908.28795.exe
Resource
win10v20201028
0 signatures
0 seconds
General
-
Target
SecuriteInfo.com.Variant.Zusy.302928.14908.28795.exe
-
Size
2.0MB
-
MD5
c888104f77298579ff06a0d1763c1ed0
-
SHA1
5553690125e9c37a55e02c711aa382e0c302f730
-
SHA256
43aaafade33a83e843804112e94bb7870e2b6c0bf001d256611bfbca9360c9b6
-
SHA512
d6f2648cda5a6495e8c674e1901b679b92fce2b95fd51c97dc651c178da43f469f73e9b73c3fcb5065a8aa0c51dd60706a7d8f4d68e7c1ac7541def456346bf8
Score
1/10
Malware Config
Signatures
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
SecuriteInfo.com.Variant.Zusy.302928.14908.28795.exeSecuriteInfo.com.Variant.Zusy.302928.14908.28795.exepid process 1980 SecuriteInfo.com.Variant.Zusy.302928.14908.28795.exe 1728 SecuriteInfo.com.Variant.Zusy.302928.14908.28795.exe 1728 SecuriteInfo.com.Variant.Zusy.302928.14908.28795.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
SecuriteInfo.com.Variant.Zusy.302928.14908.28795.execmd.exedescription pid process target process PID 1980 wrote to memory of 1728 1980 SecuriteInfo.com.Variant.Zusy.302928.14908.28795.exe SecuriteInfo.com.Variant.Zusy.302928.14908.28795.exe PID 1980 wrote to memory of 1728 1980 SecuriteInfo.com.Variant.Zusy.302928.14908.28795.exe SecuriteInfo.com.Variant.Zusy.302928.14908.28795.exe PID 1980 wrote to memory of 1728 1980 SecuriteInfo.com.Variant.Zusy.302928.14908.28795.exe SecuriteInfo.com.Variant.Zusy.302928.14908.28795.exe PID 1980 wrote to memory of 1728 1980 SecuriteInfo.com.Variant.Zusy.302928.14908.28795.exe SecuriteInfo.com.Variant.Zusy.302928.14908.28795.exe PID 1980 wrote to memory of 1588 1980 SecuriteInfo.com.Variant.Zusy.302928.14908.28795.exe cmd.exe PID 1980 wrote to memory of 1588 1980 SecuriteInfo.com.Variant.Zusy.302928.14908.28795.exe cmd.exe PID 1980 wrote to memory of 1588 1980 SecuriteInfo.com.Variant.Zusy.302928.14908.28795.exe cmd.exe PID 1980 wrote to memory of 1588 1980 SecuriteInfo.com.Variant.Zusy.302928.14908.28795.exe cmd.exe PID 1588 wrote to memory of 780 1588 cmd.exe PING.EXE PID 1588 wrote to memory of 780 1588 cmd.exe PING.EXE PID 1588 wrote to memory of 780 1588 cmd.exe PING.EXE PID 1588 wrote to memory of 780 1588 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Zusy.302928.14908.28795.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Zusy.302928.14908.28795.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Zusy.302928.14908.28795.exeC:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Zusy.302928.14908.28795.exe /C2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Zusy.302928.14908.28795.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping.exe -n 6 127.0.0.13⤵
- Runs ping.exe