Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
03-12-2020 16:53
General
-
Target
winserv.exe
-
Size
2.7MB
-
MD5
cf2ab077a46219b6ce4a53517dd489ea
-
SHA1
651b8d1377910e4728e85dcd231e269313ab9e1d
-
SHA256
609b0a416f9b16a6df9b967dc32cd739402af31566e019a8fb8abdf3cb573e30
-
SHA512
53fb1ac822467168ea8e7abdd72c78cdd90070b10773ce8c700c6784ab4cc3a03eb53887d158ce3a27779a5fbcf3300d2ccbedab79a34bfd42ddc91f68dbdad7
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\winserv.exe"C:\Users\Admin\AppData\Local\Temp\winserv.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\winserv.exeC:\Users\Admin\AppData\Local\Temp\winserv.exe -second2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-