Analysis
- max time kernel
112s - max time network
42s - platform
windows7_x64 - resource
win7v20210408 - submitted
13/10/2021, 01:28
Static task
static1
Behavioral task
behavioral1
Sample
2021 Company Info + Product List.pif.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
2021 Company Info + Product List.pif.exe
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
General
- Target 2021 Company Info + Product List.pif.exe
- Size 793KB
- Sample211013-bvn5lsdcal
- SHA256 84c4af3a72552f827a6a2b44a64ee3e06bb01f65e657b8982e5ccb49ddbe7211
- MD5 691001491c968bbc73a4d1c98e3bbbf6
- SHA1 666e2f657c0ad9e3ff6065065fc6091a026c5edd
- SHA512 96f95e990e4e0f044383e8e7cc7e80e1f88d488d357b692333e7548c34b9b8885180f334b4625f186c10fee245cceedf1672a83c485a9293f3c531e3595c4560
- MD5 SHA1 SHA512
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 800 2021 Company Info + Product List.pif.exe 800 2021 Company Info + Product List.pif.exe 800 2021 Company Info + Product List.pif.exe 800 2021 Company Info + Product List.pif.exe 800 2021 Company Info + Product List.pif.exe 800 2021 Company Info + Product List.pif.exe 800 2021 Company Info + Product List.pif.exe 800 2021 Company Info + Product List.pif.exe 800 2021 Company Info + Product List.pif.exe 800 2021 Company Info + Product List.pif.exe 800 2021 Company Info + Product List.pif.exe 800 2021 Company Info + Product List.pif.exe 800 2021 Company Info + Product List.pif.exe 800 2021 Company Info + Product List.pif.exe 800 2021 Company Info + Product List.pif.exe 800 2021 Company Info + Product List.pif.exe 800 2021 Company Info + Product List.pif.exe 800 2021 Company Info + Product List.pif.exe 800 2021 Company Info + Product List.pif.exe 800 2021 Company Info + Product List.pif.exe 800 2021 Company Info + Product List.pif.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 800 2021 Company Info + Product List.pif.exe - Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 800 wrote to memory of 1256 800 2021 Company Info + Product List.pif.exe 27 PID 800 wrote to memory of 1256 800 2021 Company Info + Product List.pif.exe 27 PID 800 wrote to memory of 1256 800 2021 Company Info + Product List.pif.exe 27 PID 800 wrote to memory of 1256 800 2021 Company Info + Product List.pif.exe 27 PID 800 wrote to memory of 1276 800 2021 Company Info + Product List.pif.exe 28 PID 800 wrote to memory of 1276 800 2021 Company Info + Product List.pif.exe 28 PID 800 wrote to memory of 1276 800 2021 Company Info + Product List.pif.exe 28 PID 800 wrote to memory of 1276 800 2021 Company Info + Product List.pif.exe 28 PID 800 wrote to memory of 1352 800 2021 Company Info + Product List.pif.exe 29 PID 800 wrote to memory of 1352 800 2021 Company Info + Product List.pif.exe 29 PID 800 wrote to memory of 1352 800 2021 Company Info + Product List.pif.exe 29 PID 800 wrote to memory of 1352 800 2021 Company Info + Product List.pif.exe 29 PID 800 wrote to memory of 1672 800 2021 Company Info + Product List.pif.exe 30 PID 800 wrote to memory of 1672 800 2021 Company Info + Product List.pif.exe 30 PID 800 wrote to memory of 1672 800 2021 Company Info + Product List.pif.exe 30 PID 800 wrote to memory of 1672 800 2021 Company Info + Product List.pif.exe 30 PID 800 wrote to memory of 1648 800 2021 Company Info + Product List.pif.exe 31 PID 800 wrote to memory of 1648 800 2021 Company Info + Product List.pif.exe 31 PID 800 wrote to memory of 1648 800 2021 Company Info + Product List.pif.exe 31 PID 800 wrote to memory of 1648 800 2021 Company Info + Product List.pif.exe 31 PID 800 wrote to memory of 1572 800 2021 Company Info + Product List.pif.exe 32 PID 800 wrote to memory of 1572 800 2021 Company Info + Product List.pif.exe 32 PID 800 wrote to memory of 1572 800 2021 Company Info + Product List.pif.exe 32 PID 800 wrote to memory of 1572 800 2021 Company Info + Product List.pif.exe 32 PID 800 wrote to memory of 1580 800 2021 Company Info + Product List.pif.exe 33 PID 800 wrote to memory of 1580 800 2021 Company Info + Product List.pif.exe 33 PID 800 wrote to memory of 1580 800 2021 Company Info + Product List.pif.exe 33 PID 800 wrote to memory of 1580 800 2021 Company Info + Product List.pif.exe 33 PID 800 wrote to memory of 1604 800 2021 Company Info + Product List.pif.exe 34 PID 800 wrote to memory of 1604 800 2021 Company Info + Product List.pif.exe 34 PID 800 wrote to memory of 1604 800 2021 Company Info + Product List.pif.exe 34 PID 800 wrote to memory of 1604 800 2021 Company Info + Product List.pif.exe 34 PID 800 wrote to memory of 1456 800 2021 Company Info + Product List.pif.exe 35 PID 800 wrote to memory of 1456 800 2021 Company Info + Product List.pif.exe 35 PID 800 wrote to memory of 1456 800 2021 Company Info + Product List.pif.exe 35 PID 800 wrote to memory of 1456 800 2021 Company Info + Product List.pif.exe 35 PID 800 wrote to memory of 1796 800 2021 Company Info + Product List.pif.exe 36 PID 800 wrote to memory of 1796 800 2021 Company Info + Product List.pif.exe 36 PID 800 wrote to memory of 1796 800 2021 Company Info + Product List.pif.exe 36 PID 800 wrote to memory of 1796 800 2021 Company Info + Product List.pif.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\2021 Company Info + Product List.pif.exe"C:\Users\Admin\AppData\Local\Temp\2021 Company Info + Product List.pif.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Users\Admin\AppData\Local\Temp\2021 Company Info + Product List.pif.exe"C:\Users\Admin\AppData\Local\Temp\2021 Company Info + Product List.pif.exe"2⤵PID:1256
-
-
C:\Users\Admin\AppData\Local\Temp\2021 Company Info + Product List.pif.exe"C:\Users\Admin\AppData\Local\Temp\2021 Company Info + Product List.pif.exe"2⤵PID:1276
-
-
C:\Users\Admin\AppData\Local\Temp\2021 Company Info + Product List.pif.exe"C:\Users\Admin\AppData\Local\Temp\2021 Company Info + Product List.pif.exe"2⤵PID:1352
-
-
C:\Users\Admin\AppData\Local\Temp\2021 Company Info + Product List.pif.exe"C:\Users\Admin\AppData\Local\Temp\2021 Company Info + Product List.pif.exe"2⤵PID:1672
-
-
C:\Users\Admin\AppData\Local\Temp\2021 Company Info + Product List.pif.exe"C:\Users\Admin\AppData\Local\Temp\2021 Company Info + Product List.pif.exe"2⤵PID:1648
-
-
C:\Users\Admin\AppData\Local\Temp\2021 Company Info + Product List.pif.exe"C:\Users\Admin\AppData\Local\Temp\2021 Company Info + Product List.pif.exe"2⤵PID:1572
-
-
C:\Users\Admin\AppData\Local\Temp\2021 Company Info + Product List.pif.exe"C:\Users\Admin\AppData\Local\Temp\2021 Company Info + Product List.pif.exe"2⤵PID:1580
-
-
C:\Users\Admin\AppData\Local\Temp\2021 Company Info + Product List.pif.exe"C:\Users\Admin\AppData\Local\Temp\2021 Company Info + Product List.pif.exe"2⤵PID:1604
-
-
C:\Users\Admin\AppData\Local\Temp\2021 Company Info + Product List.pif.exe"C:\Users\Admin\AppData\Local\Temp\2021 Company Info + Product List.pif.exe"2⤵PID:1456
-
-
C:\Users\Admin\AppData\Local\Temp\2021 Company Info + Product List.pif.exe"C:\Users\Admin\AppData\Local\Temp\2021 Company Info + Product List.pif.exe"2⤵PID:1796
-