Analysis
- max time kernel
147s - max time network
146s - platform
windows7_x64 - resource
win7v20201028 - submitted
12/11/2020, 19:22
Static task
static1
Behavioral task
behavioral1
Sample
3243429608.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
3243429608.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 3243429608.exe
- Size 32KB
- Sample201112-2nlef51baa
- SHA256 2c97e3b4c0e4ced6b5c8b1be6a3cea5597fad4c5c24e718666729eb2f7c94881
- MD5 d85f6f1ab99836783cebfeff7ffe5168
- SHA1 3dd51ce035d0c0aace9fb60ba2d0a24d511d1cb0
- SHA512 49c6f02793c4b7a76deef19ec1761889ea19034db313b0933881a4a2056a3d0859fc679256bd05d0b1f2d0a996817886f8b914c296b8e0035e3ea0cf3601d484
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Blacklisted process makes network request 1 IoCs
flow pid Process 8 792 WScript.exe - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tmp1323.tmp.js WScript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tmp1323.tmp.js WScript.exe - Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 744 3243429608.exe Token: 33 744 3243429608.exe Token: SeIncBasePriorityPrivilege 744 3243429608.exe Token: 33 744 3243429608.exe Token: SeIncBasePriorityPrivilege 744 3243429608.exe Token: 33 744 3243429608.exe Token: SeIncBasePriorityPrivilege 744 3243429608.exe Token: 33 744 3243429608.exe Token: SeIncBasePriorityPrivilege 744 3243429608.exe Token: 33 744 3243429608.exe Token: SeIncBasePriorityPrivilege 744 3243429608.exe Token: 33 744 3243429608.exe Token: SeIncBasePriorityPrivilege 744 3243429608.exe Token: 33 744 3243429608.exe Token: SeIncBasePriorityPrivilege 744 3243429608.exe Token: 33 744 3243429608.exe Token: SeIncBasePriorityPrivilege 744 3243429608.exe Token: 33 744 3243429608.exe Token: SeIncBasePriorityPrivilege 744 3243429608.exe Token: 33 744 3243429608.exe Token: SeIncBasePriorityPrivilege 744 3243429608.exe Token: 33 744 3243429608.exe Token: SeIncBasePriorityPrivilege 744 3243429608.exe Token: 33 744 3243429608.exe Token: SeIncBasePriorityPrivilege 744 3243429608.exe Token: 33 744 3243429608.exe Token: SeIncBasePriorityPrivilege 744 3243429608.exe Token: 33 744 3243429608.exe Token: SeIncBasePriorityPrivilege 744 3243429608.exe Token: 33 744 3243429608.exe Token: SeIncBasePriorityPrivilege 744 3243429608.exe Token: 33 744 3243429608.exe Token: SeIncBasePriorityPrivilege 744 3243429608.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 744 wrote to memory of 792 744 3243429608.exe 30 PID 744 wrote to memory of 792 744 3243429608.exe 30 PID 744 wrote to memory of 792 744 3243429608.exe 30 PID 744 wrote to memory of 792 744 3243429608.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\3243429608.exe"C:\Users\Admin\AppData\Local\Temp\3243429608.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\tmp1323.tmp.js"2⤵
- Blacklisted process makes network request
- Drops startup file
PID:792
-