Analysis
- max time kernel
150s - max time network
68s - platform
windows10_x64 - resource
win10v20210408 - submitted
08/07/2021, 16:52
Static task
static1
Behavioral task
behavioral1
Sample
Virus.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Virus.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target Virus.exe
- Size 1.9MB
- Sample210708-ypaezbsv3x
- SHA256 77c456179c7a49c5afaa4d2d57fcad9571e0dabab473cf8b435a67f6e3772704
- MD5 d430e5cc4b4baadd10a4de9144a8ffbb
- SHA1 4a726b0c8c491ea3df97a9d918b246ec609de295
- SHA512 3335a431b831c13a41beaaaa1e1432e41aee45a040d8dfef6766fd95ca2d2b0d35b6aa27da259e3adc9a29ace58a50862b490cbe35bc0256e7690054cdeb15c8
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Disables Task Manager via registry modification
- Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 628 Virus.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 628 Virus.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe 628 Virus.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Virus.exe"C:\Users\Admin\AppData\Local\Temp\Virus.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:628
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1508