Analysis
-
max time kernel
38s -
max time network
33s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
08-05-2021 20:05
Behavioral task
behavioral1
Sample
7a51872b8369ac8cc85e0f1a76e8706cf91de1a4b50758c939cdfd63605ed254.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
7a51872b8369ac8cc85e0f1a76e8706cf91de1a4b50758c939cdfd63605ed254.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
7a51872b8369ac8cc85e0f1a76e8706cf91de1a4b50758c939cdfd63605ed254.exe
-
Size
225KB
-
MD5
d7cbeb5af00adb5d319db6fbeb0e35b1
-
SHA1
f7a8658bc159191875e8c436735f3852dd1ebdcb
-
SHA256
7a51872b8369ac8cc85e0f1a76e8706cf91de1a4b50758c939cdfd63605ed254
-
SHA512
d39341cd3e7dd01d2ad500a8765c9c7e443eac01ac659a8bc39540718f4887fc7fad70b07b57d5a4aaa8557180305ba4ed7b12965dfad67a3b3d13e5fe924a5e
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 32 IoCs
Processes:
taskmgr.exepid process 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid process 1660 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
taskmgr.exedescription pid process Token: SeDebugPrivilege 1660 taskmgr.exe Token: SeSecurityPrivilege 1660 taskmgr.exe Token: SeTakeOwnershipPrivilege 1660 taskmgr.exe -
Suspicious use of FindShellTrayWindow 60 IoCs
Processes:
taskmgr.exepid process 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe -
Suspicious use of SendNotifyMessage 59 IoCs
Processes:
taskmgr.exepid process 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a51872b8369ac8cc85e0f1a76e8706cf91de1a4b50758c939cdfd63605ed254.exe"C:\Users\Admin\AppData\Local\Temp\7a51872b8369ac8cc85e0f1a76e8706cf91de1a4b50758c939cdfd63605ed254.exe"1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage