Analysis
-
max time kernel
123s -
max time network
103s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
20-09-2021 10:12
Static task
static1
Behavioral task
behavioral1
Sample
ORDER WORKBOOK.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ORDER WORKBOOK.exe
Resource
win10-en
windows10_x64
0 signatures
0 seconds
General
-
Target
ORDER WORKBOOK.exe
-
Size
1.3MB
-
MD5
38c3c643e80618c83b80b990ae16abe2
-
SHA1
ee93f02563f008c2715c26b4f8478410e09babcd
-
SHA256
ff2f7cc30d0eca889fbe37a6ea28172ac1dc0b2ea3563a622cc7de25a96e07f6
-
SHA512
26328038bbbb4523fd0dbfa8338a1bb09833a5c70de4240aa29944f4d103d358afe673246b924bb69a1f4134b0e945cf03b40685970e863a7f29d5ed02c24111
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
ORDER WORKBOOK.exepid process 2012 ORDER WORKBOOK.exe 2012 ORDER WORKBOOK.exe 2012 ORDER WORKBOOK.exe 2012 ORDER WORKBOOK.exe 2012 ORDER WORKBOOK.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ORDER WORKBOOK.exedescription pid process Token: SeDebugPrivilege 2012 ORDER WORKBOOK.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
ORDER WORKBOOK.exedescription pid process target process PID 2012 wrote to memory of 1764 2012 ORDER WORKBOOK.exe ORDER WORKBOOK.exe PID 2012 wrote to memory of 1764 2012 ORDER WORKBOOK.exe ORDER WORKBOOK.exe PID 2012 wrote to memory of 1764 2012 ORDER WORKBOOK.exe ORDER WORKBOOK.exe PID 2012 wrote to memory of 1764 2012 ORDER WORKBOOK.exe ORDER WORKBOOK.exe PID 2012 wrote to memory of 1792 2012 ORDER WORKBOOK.exe ORDER WORKBOOK.exe PID 2012 wrote to memory of 1792 2012 ORDER WORKBOOK.exe ORDER WORKBOOK.exe PID 2012 wrote to memory of 1792 2012 ORDER WORKBOOK.exe ORDER WORKBOOK.exe PID 2012 wrote to memory of 1792 2012 ORDER WORKBOOK.exe ORDER WORKBOOK.exe PID 2012 wrote to memory of 1804 2012 ORDER WORKBOOK.exe ORDER WORKBOOK.exe PID 2012 wrote to memory of 1804 2012 ORDER WORKBOOK.exe ORDER WORKBOOK.exe PID 2012 wrote to memory of 1804 2012 ORDER WORKBOOK.exe ORDER WORKBOOK.exe PID 2012 wrote to memory of 1804 2012 ORDER WORKBOOK.exe ORDER WORKBOOK.exe PID 2012 wrote to memory of 1720 2012 ORDER WORKBOOK.exe ORDER WORKBOOK.exe PID 2012 wrote to memory of 1720 2012 ORDER WORKBOOK.exe ORDER WORKBOOK.exe PID 2012 wrote to memory of 1720 2012 ORDER WORKBOOK.exe ORDER WORKBOOK.exe PID 2012 wrote to memory of 1720 2012 ORDER WORKBOOK.exe ORDER WORKBOOK.exe PID 2012 wrote to memory of 1708 2012 ORDER WORKBOOK.exe ORDER WORKBOOK.exe PID 2012 wrote to memory of 1708 2012 ORDER WORKBOOK.exe ORDER WORKBOOK.exe PID 2012 wrote to memory of 1708 2012 ORDER WORKBOOK.exe ORDER WORKBOOK.exe PID 2012 wrote to memory of 1708 2012 ORDER WORKBOOK.exe ORDER WORKBOOK.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ORDER WORKBOOK.exe"C:\Users\Admin\AppData\Local\Temp\ORDER WORKBOOK.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ORDER WORKBOOK.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\ORDER WORKBOOK.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\ORDER WORKBOOK.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\ORDER WORKBOOK.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\ORDER WORKBOOK.exe"{path}"2⤵