Analysis
- max time kernel
162s - max time network
167s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
15/02/2022, 12:04
Static task
static1
Behavioral task
behavioral1
Sample
NOVO PEDIDO DE COMPRA.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
NOVO PEDIDO DE COMPRA.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target NOVO PEDIDO DE COMPRA.exe
- Size 741KB
- Sample220215-n8lymaeef3
- SHA256 54cfa1f93d985c0bf952e00247f781f36988dffec0cb8d83f79fa3e41d98b335
- MD5 4049ea10c061ecd53c69f0c0a2afe683
- SHA1 5e3a42cfcd133343ee81cc1bdfdf9fe86e1a7065
- SHA512 d4e509a89f3087525934a380fc08da1d20660472e5fd855bd7a259c0348fc95f5f8e129d77ed239a65361779cef769b42228a9f0eb47a68bcd21c16089204637
- MD5 SHA1 SHA512
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 4572 NOVO PEDIDO DE COMPRA.exe 4572 NOVO PEDIDO DE COMPRA.exe 4572 NOVO PEDIDO DE COMPRA.exe 4572 NOVO PEDIDO DE COMPRA.exe 4572 NOVO PEDIDO DE COMPRA.exe 4572 NOVO PEDIDO DE COMPRA.exe 4572 NOVO PEDIDO DE COMPRA.exe 4572 NOVO PEDIDO DE COMPRA.exe 4572 NOVO PEDIDO DE COMPRA.exe 4572 NOVO PEDIDO DE COMPRA.exe 4572 NOVO PEDIDO DE COMPRA.exe 4572 NOVO PEDIDO DE COMPRA.exe 4572 NOVO PEDIDO DE COMPRA.exe 4572 NOVO PEDIDO DE COMPRA.exe 4572 NOVO PEDIDO DE COMPRA.exe 4572 NOVO PEDIDO DE COMPRA.exe 4572 NOVO PEDIDO DE COMPRA.exe 4572 NOVO PEDIDO DE COMPRA.exe 4572 NOVO PEDIDO DE COMPRA.exe 4572 NOVO PEDIDO DE COMPRA.exe 4572 NOVO PEDIDO DE COMPRA.exe 4572 NOVO PEDIDO DE COMPRA.exe 4572 NOVO PEDIDO DE COMPRA.exe 4572 NOVO PEDIDO DE COMPRA.exe 4572 NOVO PEDIDO DE COMPRA.exe 4572 NOVO PEDIDO DE COMPRA.exe 4572 NOVO PEDIDO DE COMPRA.exe 4572 NOVO PEDIDO DE COMPRA.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2316 svchost.exe Token: SeCreatePagefilePrivilege 2316 svchost.exe Token: SeShutdownPrivilege 2316 svchost.exe Token: SeCreatePagefilePrivilege 2316 svchost.exe Token: SeShutdownPrivilege 2316 svchost.exe Token: SeCreatePagefilePrivilege 2316 svchost.exe Token: SeSecurityPrivilege 4388 TiWorker.exe Token: SeRestorePrivilege 4388 TiWorker.exe Token: SeBackupPrivilege 4388 TiWorker.exe Token: SeBackupPrivilege 4388 TiWorker.exe Token: SeRestorePrivilege 4388 TiWorker.exe Token: SeSecurityPrivilege 4388 TiWorker.exe Token: SeBackupPrivilege 4388 TiWorker.exe Token: SeRestorePrivilege 4388 TiWorker.exe Token: SeSecurityPrivilege 4388 TiWorker.exe Token: SeBackupPrivilege 4388 TiWorker.exe Token: SeRestorePrivilege 4388 TiWorker.exe Token: SeSecurityPrivilege 4388 TiWorker.exe Token: SeBackupPrivilege 4388 TiWorker.exe Token: SeRestorePrivilege 4388 TiWorker.exe Token: SeSecurityPrivilege 4388 TiWorker.exe Token: SeBackupPrivilege 4388 TiWorker.exe Token: SeRestorePrivilege 4388 TiWorker.exe Token: SeSecurityPrivilege 4388 TiWorker.exe Token: SeBackupPrivilege 4388 TiWorker.exe Token: SeRestorePrivilege 4388 TiWorker.exe Token: SeSecurityPrivilege 4388 TiWorker.exe Token: SeBackupPrivilege 4388 TiWorker.exe Token: SeRestorePrivilege 4388 TiWorker.exe Token: SeSecurityPrivilege 4388 TiWorker.exe Token: SeBackupPrivilege 4388 TiWorker.exe Token: SeRestorePrivilege 4388 TiWorker.exe Token: SeSecurityPrivilege 4388 TiWorker.exe Token: SeBackupPrivilege 4388 TiWorker.exe Token: SeRestorePrivilege 4388 TiWorker.exe Token: SeSecurityPrivilege 4388 TiWorker.exe Token: SeBackupPrivilege 4388 TiWorker.exe Token: SeRestorePrivilege 4388 TiWorker.exe Token: SeSecurityPrivilege 4388 TiWorker.exe Token: SeBackupPrivilege 4388 TiWorker.exe Token: SeRestorePrivilege 4388 TiWorker.exe Token: SeSecurityPrivilege 4388 TiWorker.exe Token: SeBackupPrivilege 4388 TiWorker.exe Token: SeRestorePrivilege 4388 TiWorker.exe Token: SeSecurityPrivilege 4388 TiWorker.exe Token: SeBackupPrivilege 4388 TiWorker.exe Token: SeRestorePrivilege 4388 TiWorker.exe Token: SeSecurityPrivilege 4388 TiWorker.exe Token: SeBackupPrivilege 4388 TiWorker.exe Token: SeRestorePrivilege 4388 TiWorker.exe Token: SeSecurityPrivilege 4388 TiWorker.exe Token: SeBackupPrivilege 4388 TiWorker.exe Token: SeRestorePrivilege 4388 TiWorker.exe Token: SeSecurityPrivilege 4388 TiWorker.exe Token: SeBackupPrivilege 4388 TiWorker.exe Token: SeRestorePrivilege 4388 TiWorker.exe Token: SeSecurityPrivilege 4388 TiWorker.exe Token: SeBackupPrivilege 4388 TiWorker.exe Token: SeRestorePrivilege 4388 TiWorker.exe Token: SeSecurityPrivilege 4388 TiWorker.exe Token: SeBackupPrivilege 4388 TiWorker.exe Token: SeRestorePrivilege 4388 TiWorker.exe Token: SeSecurityPrivilege 4388 TiWorker.exe Token: SeBackupPrivilege 4388 TiWorker.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NOVO PEDIDO DE COMPRA.exe"C:\Users\Admin\AppData\Local\Temp\NOVO PEDIDO DE COMPRA.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4572
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2316
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4388