Analysis
-
max time kernel
130s -
max time network
132s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
29-01-2022 19:02
Static task
static1
Behavioral task
behavioral1
Sample
e394ab8a308e92ca6cf10ffbb951b3225685278b55a4b00c68c4c763d0601efa.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
e394ab8a308e92ca6cf10ffbb951b3225685278b55a4b00c68c4c763d0601efa.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
e394ab8a308e92ca6cf10ffbb951b3225685278b55a4b00c68c4c763d0601efa.exe
-
Size
53KB
-
MD5
3739bbf831d04e8a2b06275cd3af371d
-
SHA1
1bb0cb1be5227645c14b5757932df14b1b52c3cd
-
SHA256
e394ab8a308e92ca6cf10ffbb951b3225685278b55a4b00c68c4c763d0601efa
-
SHA512
7aa6b6cc9cf36d847580553487b52ff446310a3b8ae605d93d42090dd35e056cbafb0cf95f2359e440c262f28707478b7152d72e647990c3a660757a90bd0099
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\nvidia_mainApp = "C:\\Users\\Admin\\AppData\\Roaming\\Skype\\skypeupdate.exe" e394ab8a308e92ca6cf10ffbb951b3225685278b55a4b00c68c4c763d0601efa.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1536 e394ab8a308e92ca6cf10ffbb951b3225685278b55a4b00c68c4c763d0601efa.exe 1536 e394ab8a308e92ca6cf10ffbb951b3225685278b55a4b00c68c4c763d0601efa.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1536 e394ab8a308e92ca6cf10ffbb951b3225685278b55a4b00c68c4c763d0601efa.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e394ab8a308e92ca6cf10ffbb951b3225685278b55a4b00c68c4c763d0601efa.exe"C:\Users\Admin\AppData\Local\Temp\e394ab8a308e92ca6cf10ffbb951b3225685278b55a4b00c68c4c763d0601efa.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1536