Analysis
-
max time kernel
4265240s -
max time network
311s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
14-01-2022 16:03
Static task
static1
Behavioral task
behavioral1
Sample
SpyHunter-5.11-5-26253-Installer.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SpyHunter-5.11-5-26253-Installer.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
SpyHunter-5.11-5-26253-Installer.exe
-
Size
7.4MB
-
MD5
911736872bcb9f85b9181c7d785ee032
-
SHA1
806691ea5f3cf3cd335b00e436c51c9cb85bc9a4
-
SHA256
46dda74095b229c3724b4ef7e5f4c05b0b0e15426ca76e9ac947475f21459d19
-
SHA512
016c73a7e8ecad84ba73e220a37869bdf8465411a2085133112ba1215b92553c3ff7194e425b94b13b43f0152a0c1194376c87c5ffbd2441df0f3236d2b8fda6
Score
4/10
Malware Config
Signatures
-
Drops file in Program Files directory 64 IoCs
Processes:
SpyHunter-5.11-5-26253-Installer.exedescription ioc process File created C:\Program Files\EnigmaSoft\SpyHunter\Languages\Croatian.lng SpyHunter-5.11-5-26253-Installer.exe File opened for modification C:\Program Files\EnigmaSoft\SpyHunter\Languages\Norwegian.lng SpyHunter-5.11-5-26253-Installer.exe File created C:\Program Files\EnigmaSoft\SpyHunter\Languages\Romanian.lng SpyHunter-5.11-5-26253-Installer.exe File created C:\Program Files\EnigmaSoft\SpyHunter\Languages\Russian.lng SpyHunter-5.11-5-26253-Installer.exe File opened for modification C:\Program Files\EnigmaSoft\SpyHunter\Languages\Serbian.lng SpyHunter-5.11-5-26253-Installer.exe File created C:\Program Files\EnigmaSoft\SpyHunter\SpyHunter5.exe SpyHunter-5.11-5-26253-Installer.exe File opened for modification C:\Program Files\EnigmaSoft\SpyHunter\ShMonitor.exe SpyHunter-5.11-5-26253-Installer.exe File opened for modification C:\Program Files\EnigmaSoft\SpyHunter\Languages\Czech.lng SpyHunter-5.11-5-26253-Installer.exe File opened for modification C:\Program Files\EnigmaSoft\SpyHunter\Languages\Greek.lng SpyHunter-5.11-5-26253-Installer.exe File opened for modification C:\Program Files\EnigmaSoft\SpyHunter\Languages\Italian.lng SpyHunter-5.11-5-26253-Installer.exe File created C:\Program Files\EnigmaSoft\SpyHunter\Languages\Korean.lng SpyHunter-5.11-5-26253-Installer.exe File opened for modification C:\Program Files\EnigmaSoft\SpyHunter\license.txt SpyHunter-5.11-5-26253-Installer.exe File created C:\Program Files\EnigmaSoft\SpyHunter\Languages\English.lng SpyHunter-5.11-5-26253-Installer.exe File opened for modification C:\Program Files\EnigmaSoft\SpyHunter\Languages\Bulgarian.lng SpyHunter-5.11-5-26253-Installer.exe File created C:\Program Files\EnigmaSoft\SpyHunter\Languages\Chinese (Simplified).lng SpyHunter-5.11-5-26253-Installer.exe File opened for modification C:\Program Files\EnigmaSoft\SpyHunter\Languages\Danish.lng SpyHunter-5.11-5-26253-Installer.exe File created C:\Program Files\EnigmaSoft\SpyHunter\Languages\Norwegian.lng SpyHunter-5.11-5-26253-Installer.exe File opened for modification C:\Program Files\EnigmaSoft\SpyHunter\Languages\Albanian.lng SpyHunter-5.11-5-26253-Installer.exe File created C:\Program Files\EnigmaSoft\SpyHunter\Languages\French.lng SpyHunter-5.11-5-26253-Installer.exe File created C:\Program Files\EnigmaSoft\SpyHunter\Languages\Italian.lng SpyHunter-5.11-5-26253-Installer.exe File opened for modification C:\Program Files\EnigmaSoft\SpyHunter\Languages\Slovene.lng SpyHunter-5.11-5-26253-Installer.exe File opened for modification C:\Program Files\EnigmaSoft\SpyHunter\Languages\Turkish.lng SpyHunter-5.11-5-26253-Installer.exe File opened for modification C:\Program Files\EnigmaSoft\SpyHunter\Native.exe SpyHunter-5.11-5-26253-Installer.exe File created C:\Program Files\EnigmaSoft\SpyHunter\Native.exe SpyHunter-5.11-5-26253-Installer.exe File created C:\Program Files\EnigmaSoft\SpyHunter\Languages\Albanian.lng SpyHunter-5.11-5-26253-Installer.exe File opened for modification C:\Program Files\EnigmaSoft\SpyHunter\Languages\Japanese.lng SpyHunter-5.11-5-26253-Installer.exe File created C:\Program Files\EnigmaSoft\SpyHunter\Languages\Slovene.lng SpyHunter-5.11-5-26253-Installer.exe File created C:\Program Files\EnigmaSoft\SpyHunter\Languages\Ukrainian.lng SpyHunter-5.11-5-26253-Installer.exe File opened for modification C:\Program Files\EnigmaSoft\SpyHunter\SpyHunter5.exe SpyHunter-5.11-5-26253-Installer.exe File created C:\Program Files\EnigmaSoft\SpyHunter\Languages\Bulgarian.lng SpyHunter-5.11-5-26253-Installer.exe File opened for modification C:\Program Files\EnigmaSoft\SpyHunter\Languages\Finnish.lng SpyHunter-5.11-5-26253-Installer.exe File created C:\Program Files\EnigmaSoft\SpyHunter\Languages\Hungarian.lng SpyHunter-5.11-5-26253-Installer.exe File opened for modification C:\Program Files\EnigmaSoft\SpyHunter\Languages\Korean.lng SpyHunter-5.11-5-26253-Installer.exe File opened for modification C:\Program Files\EnigmaSoft\SpyHunter\Languages\Portuguese (Brazil).lng SpyHunter-5.11-5-26253-Installer.exe File opened for modification C:\Program Files\EnigmaSoft\SpyHunter\Languages\Russian.lng SpyHunter-5.11-5-26253-Installer.exe File created C:\Program Files\EnigmaSoft\SpyHunter\ShKernel.exe SpyHunter-5.11-5-26253-Installer.exe File created C:\Program Files\EnigmaSoft\SpyHunter\ShMonitor.exe SpyHunter-5.11-5-26253-Installer.exe File created C:\Program Files\EnigmaSoft\SpyHunter\Languages\Finnish.lng SpyHunter-5.11-5-26253-Installer.exe File created C:\Program Files\EnigmaSoft\SpyHunter\Languages\Japanese.lng SpyHunter-5.11-5-26253-Installer.exe File opened for modification C:\Program Files\EnigmaSoft\SpyHunter\Languages\Polish.lng SpyHunter-5.11-5-26253-Installer.exe File opened for modification C:\Program Files\EnigmaSoft\SpyHunter\Languages\Romanian.lng SpyHunter-5.11-5-26253-Installer.exe File opened for modification C:\Program Files\EnigmaSoft\SpyHunter\Languages\Spanish.lng SpyHunter-5.11-5-26253-Installer.exe File opened for modification C:\Program Files\EnigmaSoft\SpyHunter\Languages\Chinese (Simplified).lng SpyHunter-5.11-5-26253-Installer.exe File opened for modification C:\Program Files\EnigmaSoft\SpyHunter\Languages\French.lng SpyHunter-5.11-5-26253-Installer.exe File opened for modification C:\Program Files\EnigmaSoft\SpyHunter\Languages\German.lng SpyHunter-5.11-5-26253-Installer.exe File created C:\Program Files\EnigmaSoft\SpyHunter\Languages\Lithuanian.lng SpyHunter-5.11-5-26253-Installer.exe File created C:\Program Files\EnigmaSoft\SpyHunter\Languages\Polish.lng SpyHunter-5.11-5-26253-Installer.exe File created C:\Program Files\EnigmaSoft\SpyHunter\Languages\Serbian.lng SpyHunter-5.11-5-26253-Installer.exe File created C:\Program Files\EnigmaSoft\SpyHunter\purl.dat SpyHunter-5.11-5-26253-Installer.exe File opened for modification C:\Program Files\EnigmaSoft\SpyHunter\ShKernel.exe SpyHunter-5.11-5-26253-Installer.exe File created C:\Program Files\EnigmaSoft\SpyHunter\license.txt SpyHunter-5.11-5-26253-Installer.exe File opened for modification C:\Program Files\EnigmaSoft\SpyHunter\Languages\English.lng SpyHunter-5.11-5-26253-Installer.exe File opened for modification C:\Program Files\EnigmaSoft\SpyHunter\Languages\Hungarian.lng SpyHunter-5.11-5-26253-Installer.exe File created C:\Program Files\EnigmaSoft\SpyHunter\Languages\Indonesian.lng SpyHunter-5.11-5-26253-Installer.exe File created C:\Program Files\EnigmaSoft\SpyHunter\Languages\Czech.lng SpyHunter-5.11-5-26253-Installer.exe File created C:\Program Files\EnigmaSoft\SpyHunter\Languages\Portuguese (Portugal).lng SpyHunter-5.11-5-26253-Installer.exe File opened for modification C:\Program Files\EnigmaSoft\SpyHunter\Languages\Ukrainian.lng SpyHunter-5.11-5-26253-Installer.exe File created C:\Program Files\EnigmaSoft\SpyHunter\Languages\Chinese (Traditional).lng SpyHunter-5.11-5-26253-Installer.exe File opened for modification C:\Program Files\EnigmaSoft\SpyHunter\Languages\Chinese (Traditional).lng SpyHunter-5.11-5-26253-Installer.exe File created C:\Program Files\EnigmaSoft\SpyHunter\Languages\German.lng SpyHunter-5.11-5-26253-Installer.exe File created C:\Program Files\EnigmaSoft\SpyHunter\Languages\Greek.lng SpyHunter-5.11-5-26253-Installer.exe File created C:\Program Files\EnigmaSoft\SpyHunter\Languages\Dutch.lng SpyHunter-5.11-5-26253-Installer.exe File created C:\Program Files\EnigmaSoft\SpyHunter\Languages\Turkish.lng SpyHunter-5.11-5-26253-Installer.exe File opened for modification C:\Program Files\EnigmaSoft\SpyHunter\Languages\Croatian.lng SpyHunter-5.11-5-26253-Installer.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
SpyHunter-5.11-5-26253-Installer.exepid process 3848 SpyHunter-5.11-5-26253-Installer.exe 3848 SpyHunter-5.11-5-26253-Installer.exe 3848 SpyHunter-5.11-5-26253-Installer.exe 3848 SpyHunter-5.11-5-26253-Installer.exe 3848 SpyHunter-5.11-5-26253-Installer.exe 3848 SpyHunter-5.11-5-26253-Installer.exe 3848 SpyHunter-5.11-5-26253-Installer.exe 3848 SpyHunter-5.11-5-26253-Installer.exe 3848 SpyHunter-5.11-5-26253-Installer.exe 3848 SpyHunter-5.11-5-26253-Installer.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
SpyHunter-5.11-5-26253-Installer.exedescription pid process Token: SeShutdownPrivilege 3848 SpyHunter-5.11-5-26253-Installer.exe Token: SeBackupPrivilege 3848 SpyHunter-5.11-5-26253-Installer.exe Token: SeRestorePrivilege 3848 SpyHunter-5.11-5-26253-Installer.exe Token: SeDebugPrivilege 3848 SpyHunter-5.11-5-26253-Installer.exe Token: SeTakeOwnershipPrivilege 3848 SpyHunter-5.11-5-26253-Installer.exe