Analysis
-
max time kernel
150s -
max time network
68s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
08/07/2021, 16:52
Static task
static1
Behavioral task
behavioral1
Sample
Virus.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Virus.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
Virus.exe
-
Size
1.9MB
-
MD5
d430e5cc4b4baadd10a4de9144a8ffbb
-
SHA1
4a726b0c8c491ea3df97a9d918b246ec609de295
-
SHA256
77c456179c7a49c5afaa4d2d57fcad9571e0dabab473cf8b435a67f6e3772704
-
SHA512
3335a431b831c13a41beaaaa1e1432e41aee45a040d8dfef6766fd95ca2d2b0d35b6aa27da259e3adc9a29ace58a50862b490cbe35bc0256e7690054cdeb15c8
Score
8/10
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 628 Virus.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 628 Virus.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Virus.exe"C:\Users\Admin\AppData\Local\Temp\Virus.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:628
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1508