Analysis
-
max time kernel
16s -
max time network
113s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
13-01-2021 17:38
General
-
Target
remote (2).exe
-
Size
7.1MB
-
MD5
29019ced86eb160aa754828649703769
-
SHA1
b1689f923228f42da1f9eff5709d797153fb81c1
-
SHA256
575cd45bc66b57679f2b565270c84c957bf68a8ab84833845a038aad87b7bfb0
-
SHA512
8dcff0d47180c38a0781d7fd8a01073bcaad3edf2c69654a15e9c8a8d2873071ae5bea5261e58ca2650f775243978f01e2a8d62e84319f2f88422de7d033a247
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
-
Suspicious use of FindShellTrayWindow 5 IoCs
-
Suspicious use of SendNotifyMessage 5 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\remote (2).exe"C:\Users\Admin\AppData\Local\Temp\remote (2).exe"1⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx