Resubmissions
01/12/2021, 22:56
211201-2ws33abgf4101/12/2021, 22:55
211201-2v518sgfdl101/12/2021, 22:53
211201-2t11wsbge6101/12/2021, 22:51
211201-2s416agfcm101/12/2021, 22:27
211201-2c978sbfb5101/12/2021, 22:27
211201-2c4qfsbfb2101/12/2021, 22:23
211201-2at38sbeh3430/11/2021, 22:48
211130-2q8xbsghbq130/11/2021, 22:46
211130-2p6qkscah5130/11/2021, 22:41
211130-2l6amscag61Analysis
- max time kernel
58s - max time network
14s - platform
windows7_x64 - resource
win7-en-20211104 - submitted
01/12/2021, 22:27
Static task
static1
windows7_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
General
- Target [email protected]
- Size 31KB
- Sample211201-2c978sbfb5
- SHA256 4663715548c70eec7e9cbf272171493d47a75d2652e38cca870412ea9e749fe9
- MD5 c261c6e3332d0d515c910bbf3b93aab3
- SHA1 ff730b6b2726240df4b2f0db96c424c464c65c17
- SHA512 a93bd7b1d809493917e0999d4030cb53ab7789c65f6b87e1bbac27bd8b3ad2aeb92dec0a69369c04541f5572a78f04d8dfba900624cf5bd82d7558f24d0a8e26
- MD5 SHA1 SHA512
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 576 [email protected] - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 576 wrote to memory of 240 576 [email protected] 29 PID 576 wrote to memory of 240 576 [email protected] 29 PID 576 wrote to memory of 240 576 [email protected] 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\[email protected]"C:\Users\Admin\AppData\Local\Temp\[email protected]"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Windows\system32\mountvol.exemountvol c:\ /d2⤵PID:240
-