Analysis
-
max time kernel
8s -
max time network
12s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
17-12-2020 07:14
Static task
static1
Behavioral task
behavioral1
Sample
3710baf84c794fe82141d5baa97137ee.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
3710baf84c794fe82141d5baa97137ee.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
3710baf84c794fe82141d5baa97137ee.exe
-
Size
6.4MB
-
MD5
3710baf84c794fe82141d5baa97137ee
-
SHA1
5238b145897e6ba425e9bd8f889ed5f4bfbd5a7d
-
SHA256
0d838e7b6343155a98bd1d15cab670ae29c0c20dd992c6f97f80d3791e1cbd14
-
SHA512
77e39b14ef08844678b12722995a3ba3718e99a52b6bfe1fb011b29cf2c92a4a45746c858c7e8ecbbd7e3cc406ec15f07fc605f6c28997620e2e5b2b39c29ad1
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
3710baf84c794fe82141d5baa97137ee.exepid process 1408 3710baf84c794fe82141d5baa97137ee.exe 1408 3710baf84c794fe82141d5baa97137ee.exe 1408 3710baf84c794fe82141d5baa97137ee.exe 1408 3710baf84c794fe82141d5baa97137ee.exe 1408 3710baf84c794fe82141d5baa97137ee.exe 1408 3710baf84c794fe82141d5baa97137ee.exe 1408 3710baf84c794fe82141d5baa97137ee.exe 1408 3710baf84c794fe82141d5baa97137ee.exe 1408 3710baf84c794fe82141d5baa97137ee.exe 1408 3710baf84c794fe82141d5baa97137ee.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
3710baf84c794fe82141d5baa97137ee.exedescription pid process Token: SeDebugPrivilege 1408 3710baf84c794fe82141d5baa97137ee.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
3710baf84c794fe82141d5baa97137ee.exedescription pid process target process PID 1408 wrote to memory of 804 1408 3710baf84c794fe82141d5baa97137ee.exe 3710baf84c794fe82141d5baa97137ee.exe PID 1408 wrote to memory of 804 1408 3710baf84c794fe82141d5baa97137ee.exe 3710baf84c794fe82141d5baa97137ee.exe PID 1408 wrote to memory of 804 1408 3710baf84c794fe82141d5baa97137ee.exe 3710baf84c794fe82141d5baa97137ee.exe PID 1408 wrote to memory of 804 1408 3710baf84c794fe82141d5baa97137ee.exe 3710baf84c794fe82141d5baa97137ee.exe PID 1408 wrote to memory of 792 1408 3710baf84c794fe82141d5baa97137ee.exe 3710baf84c794fe82141d5baa97137ee.exe PID 1408 wrote to memory of 792 1408 3710baf84c794fe82141d5baa97137ee.exe 3710baf84c794fe82141d5baa97137ee.exe PID 1408 wrote to memory of 792 1408 3710baf84c794fe82141d5baa97137ee.exe 3710baf84c794fe82141d5baa97137ee.exe PID 1408 wrote to memory of 792 1408 3710baf84c794fe82141d5baa97137ee.exe 3710baf84c794fe82141d5baa97137ee.exe PID 1408 wrote to memory of 1764 1408 3710baf84c794fe82141d5baa97137ee.exe 3710baf84c794fe82141d5baa97137ee.exe PID 1408 wrote to memory of 1764 1408 3710baf84c794fe82141d5baa97137ee.exe 3710baf84c794fe82141d5baa97137ee.exe PID 1408 wrote to memory of 1764 1408 3710baf84c794fe82141d5baa97137ee.exe 3710baf84c794fe82141d5baa97137ee.exe PID 1408 wrote to memory of 1764 1408 3710baf84c794fe82141d5baa97137ee.exe 3710baf84c794fe82141d5baa97137ee.exe PID 1408 wrote to memory of 684 1408 3710baf84c794fe82141d5baa97137ee.exe 3710baf84c794fe82141d5baa97137ee.exe PID 1408 wrote to memory of 684 1408 3710baf84c794fe82141d5baa97137ee.exe 3710baf84c794fe82141d5baa97137ee.exe PID 1408 wrote to memory of 684 1408 3710baf84c794fe82141d5baa97137ee.exe 3710baf84c794fe82141d5baa97137ee.exe PID 1408 wrote to memory of 684 1408 3710baf84c794fe82141d5baa97137ee.exe 3710baf84c794fe82141d5baa97137ee.exe PID 1408 wrote to memory of 604 1408 3710baf84c794fe82141d5baa97137ee.exe 3710baf84c794fe82141d5baa97137ee.exe PID 1408 wrote to memory of 604 1408 3710baf84c794fe82141d5baa97137ee.exe 3710baf84c794fe82141d5baa97137ee.exe PID 1408 wrote to memory of 604 1408 3710baf84c794fe82141d5baa97137ee.exe 3710baf84c794fe82141d5baa97137ee.exe PID 1408 wrote to memory of 604 1408 3710baf84c794fe82141d5baa97137ee.exe 3710baf84c794fe82141d5baa97137ee.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3710baf84c794fe82141d5baa97137ee.exe"C:\Users\Admin\AppData\Local\Temp\3710baf84c794fe82141d5baa97137ee.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3710baf84c794fe82141d5baa97137ee.exe"C:\Users\Admin\AppData\Local\Temp\3710baf84c794fe82141d5baa97137ee.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3710baf84c794fe82141d5baa97137ee.exe"C:\Users\Admin\AppData\Local\Temp\3710baf84c794fe82141d5baa97137ee.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3710baf84c794fe82141d5baa97137ee.exe"C:\Users\Admin\AppData\Local\Temp\3710baf84c794fe82141d5baa97137ee.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3710baf84c794fe82141d5baa97137ee.exe"C:\Users\Admin\AppData\Local\Temp\3710baf84c794fe82141d5baa97137ee.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3710baf84c794fe82141d5baa97137ee.exe"C:\Users\Admin\AppData\Local\Temp\3710baf84c794fe82141d5baa97137ee.exe"2⤵