Analysis
-
max time kernel
116s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
19-04-2022 02:37
Static task
static1
Behavioral task
behavioral1
Sample
390ed1dde4ff03adfcf67c59ee02567ac5665bb5e029eaebf0332bc81e4d1891.exe
Resource
win7-20220414-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
390ed1dde4ff03adfcf67c59ee02567ac5665bb5e029eaebf0332bc81e4d1891.exe
Resource
win10v2004-20220414-en
0 signatures
0 seconds
General
-
Target
390ed1dde4ff03adfcf67c59ee02567ac5665bb5e029eaebf0332bc81e4d1891.exe
-
Size
657KB
-
MD5
0d0823d9a5d000b80e27090754f59ee5
-
SHA1
b1f495b707ffaf53188c13f19a487dd94e7a0735
-
SHA256
390ed1dde4ff03adfcf67c59ee02567ac5665bb5e029eaebf0332bc81e4d1891
-
SHA512
52a4ae72e2685a6b6d274388b636fe63d96e5545475e521e9e250d56d4593657061502f00c6b90f5e54d05a63a9301509852804b9d705307c03f8fff739d3964
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1848 cmd.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
390ed1dde4ff03adfcf67c59ee02567ac5665bb5e029eaebf0332bc81e4d1891.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier 390ed1dde4ff03adfcf67c59ee02567ac5665bb5e029eaebf0332bc81e4d1891.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
390ed1dde4ff03adfcf67c59ee02567ac5665bb5e029eaebf0332bc81e4d1891.exedescription pid process target process PID 756 wrote to memory of 1848 756 390ed1dde4ff03adfcf67c59ee02567ac5665bb5e029eaebf0332bc81e4d1891.exe cmd.exe PID 756 wrote to memory of 1848 756 390ed1dde4ff03adfcf67c59ee02567ac5665bb5e029eaebf0332bc81e4d1891.exe cmd.exe PID 756 wrote to memory of 1848 756 390ed1dde4ff03adfcf67c59ee02567ac5665bb5e029eaebf0332bc81e4d1891.exe cmd.exe PID 756 wrote to memory of 1848 756 390ed1dde4ff03adfcf67c59ee02567ac5665bb5e029eaebf0332bc81e4d1891.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\390ed1dde4ff03adfcf67c59ee02567ac5665bb5e029eaebf0332bc81e4d1891.exe"C:\Users\Admin\AppData\Local\Temp\390ed1dde4ff03adfcf67c59ee02567ac5665bb5e029eaebf0332bc81e4d1891.exe"1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\SysWOW64\cmd.execmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\390ed1dde4ff03adfcf67c59ee02567ac5665bb5e029eaebf0332bc81e4d1891.exe"2⤵
- Deletes itself
PID:1848