Analysis
-
max time kernel
294s -
max time network
314s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
21-10-2021 03:43
Static task
static1
Behavioral task
behavioral1
Sample
Price list..exe
Resource
win7-en-20210920
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Price list..exe
Resource
win10-en-20211014
0 signatures
0 seconds
General
-
Target
Price list..exe
-
Size
215KB
-
MD5
2a64d99a0646419345e02e37dd7f6ff7
-
SHA1
c0740347f9a3694fb99dbfd5f736960b8abdd12c
-
SHA256
b720d19f181fde475d7ad19e5f623ed17bae905ede9826ae9033ad9f36b0557f
-
SHA512
58a8abd03f8abe9185218dcce197a4ed0ca465a306c8ca926b6e5a0b5d0ac8d9d97a0fe701b6f6e2d00e34339decda48d84a9057b457243333953faf25228b36
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Price list..exepid process 1508 Price list..exe 1508 Price list..exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
dw20.exepid process 1616 dw20.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Price list..exedescription pid process Token: SeDebugPrivilege 1508 Price list..exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
Price list..exedescription pid process target process PID 1508 wrote to memory of 1616 1508 Price list..exe dw20.exe PID 1508 wrote to memory of 1616 1508 Price list..exe dw20.exe PID 1508 wrote to memory of 1616 1508 Price list..exe dw20.exe PID 1508 wrote to memory of 1616 1508 Price list..exe dw20.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Price list..exe"C:\Users\Admin\AppData\Local\Temp\Price list..exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 5162⤵
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1508-53-0x0000000076B61000-0x0000000076B63000-memory.dmpFilesize
8KB
-
memory/1508-54-0x00000000004A0000-0x00000000004A1000-memory.dmpFilesize
4KB
-
memory/1616-55-0x0000000000000000-mapping.dmp
-
memory/1616-57-0x0000000000510000-0x0000000000511000-memory.dmpFilesize
4KB