Analysis
-
max time kernel
18s -
max time network
11s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
13-01-2021 07:33
Static task
static1
Behavioral task
behavioral1
Sample
PO-Scan-Documents00012910993993.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
PO-Scan-Documents00012910993993.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
PO-Scan-Documents00012910993993.exe
-
Size
177KB
-
MD5
a2c17f6556ae89a8a1683f889bffc7e9
-
SHA1
cf2aa59cc8e074dfd3d72b052beef746aba1fe6a
-
SHA256
4c61692f5b36f6b2b136958c7c315113899a1bdb1cfe7415f37c0acfdaab01a7
-
SHA512
9f18670e24387969db2fee5cbc9698cfdac86997d1b5ac63e39cf973e0170473440ed3cd0a130ab00b339bf89802b14da425f52bb5c62c651eea0c486a993b37
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\ PO-Scan-Documents00012910993993.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\owerrita = "\"C:\\Users\\Admin\\AppData\\Roaming\\owerri\\owerrinta.exe\"" PO-Scan-Documents00012910993993.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1668 wrote to memory of 980 1668 PO-Scan-Documents00012910993993.exe 29 PID 1668 wrote to memory of 980 1668 PO-Scan-Documents00012910993993.exe 29 PID 1668 wrote to memory of 980 1668 PO-Scan-Documents00012910993993.exe 29 PID 1668 wrote to memory of 980 1668 PO-Scan-Documents00012910993993.exe 29 PID 980 wrote to memory of 620 980 PO-Scan-Documents00012910993993.exe 30 PID 980 wrote to memory of 620 980 PO-Scan-Documents00012910993993.exe 30 PID 980 wrote to memory of 620 980 PO-Scan-Documents00012910993993.exe 30 PID 980 wrote to memory of 620 980 PO-Scan-Documents00012910993993.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO-Scan-Documents00012910993993.exe"C:\Users\Admin\AppData\Local\Temp\PO-Scan-Documents00012910993993.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\PO-Scan-Documents00012910993993.exe"C:\Users\Admin\AppData\Local\Temp\PO-Scan-Documents00012910993993.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵PID:620
-
-