Analysis
- max time kernel
161s - max time network
169s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
29/01/2022, 17:38
Static task
static1
Behavioral task
behavioral1
Sample
56ec7c81e26fbbab76fa82cce7b9efc16722bb0ff918cde091559b2d2dd7ee2c.exe
Resource
win7-en-20211208
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
56ec7c81e26fbbab76fa82cce7b9efc16722bb0ff918cde091559b2d2dd7ee2c.exe
Resource
win10-en-20211208
0 signatures
0 seconds
General
- Target 56ec7c81e26fbbab76fa82cce7b9efc16722bb0ff918cde091559b2d2dd7ee2c.exe
- Size 66KB
- Sample220129-v7tqeafch7
- SHA256 56ec7c81e26fbbab76fa82cce7b9efc16722bb0ff918cde091559b2d2dd7ee2c
- MD5 a3aa3a12d81c9862b18f83a77d7215ca
- SHA1 6e3e89e2f3d096ee09d4bf88410e80ef17536ab7
- SHA512 899dc5b47f1f5df3fbd0558438b365857f457cc99505fe80a5d6cb0a81fe760ae8aed8bb75c3b112e472bc9c1231bc11393eb63eb12d40688a85b42d3483e010
- MD5 SHA1 SHA512
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run\office_mainApp = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft_Windows\\windows_defender.exe" 56ec7c81e26fbbab76fa82cce7b9efc16722bb0ff918cde091559b2d2dd7ee2c.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2676 56ec7c81e26fbbab76fa82cce7b9efc16722bb0ff918cde091559b2d2dd7ee2c.exe 2676 56ec7c81e26fbbab76fa82cce7b9efc16722bb0ff918cde091559b2d2dd7ee2c.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2676 56ec7c81e26fbbab76fa82cce7b9efc16722bb0ff918cde091559b2d2dd7ee2c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\56ec7c81e26fbbab76fa82cce7b9efc16722bb0ff918cde091559b2d2dd7ee2c.exe"C:\Users\Admin\AppData\Local\Temp\56ec7c81e26fbbab76fa82cce7b9efc16722bb0ff918cde091559b2d2dd7ee2c.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2676