Analysis
-
max time kernel
42s -
max time network
63s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
12/05/2022, 19:49
Static task
static1
Behavioral task
behavioral1
Sample
df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe
-
Size
100KB
-
MD5
c7a310982da68b10360854f9cd78e718
-
SHA1
60140c28e0b7db797a771c2dee081fa3812246db
-
SHA256
df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731
-
SHA512
6747fa3f7637922eeaa0feeb25d430dc6ab66fd9f3d22e7e5fd16bad9b75528a8174c34a8baf681950b64e8cdaa6a14e37633592e843c363e75468622ebd2ec3
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Control Panel\International\Geo\Nation df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 872 wrote to memory of 1972 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 27 PID 872 wrote to memory of 1972 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 27 PID 872 wrote to memory of 1972 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 27 PID 872 wrote to memory of 1972 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 27 PID 872 wrote to memory of 1736 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 28 PID 872 wrote to memory of 1736 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 28 PID 872 wrote to memory of 1736 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 28 PID 872 wrote to memory of 1736 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 28 PID 872 wrote to memory of 1956 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 29 PID 872 wrote to memory of 1956 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 29 PID 872 wrote to memory of 1956 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 29 PID 872 wrote to memory of 1956 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 29 PID 872 wrote to memory of 1960 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 30 PID 872 wrote to memory of 1960 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 30 PID 872 wrote to memory of 1960 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 30 PID 872 wrote to memory of 1960 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 30 PID 872 wrote to memory of 1940 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 31 PID 872 wrote to memory of 1940 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 31 PID 872 wrote to memory of 1940 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 31 PID 872 wrote to memory of 1940 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 31 PID 872 wrote to memory of 1784 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 32 PID 872 wrote to memory of 1784 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 32 PID 872 wrote to memory of 1784 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 32 PID 872 wrote to memory of 1784 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 32 PID 872 wrote to memory of 1008 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 33 PID 872 wrote to memory of 1008 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 33 PID 872 wrote to memory of 1008 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 33 PID 872 wrote to memory of 1008 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 33 PID 872 wrote to memory of 1616 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 34 PID 872 wrote to memory of 1616 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 34 PID 872 wrote to memory of 1616 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 34 PID 872 wrote to memory of 1616 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 34 PID 872 wrote to memory of 1772 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 35 PID 872 wrote to memory of 1772 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 35 PID 872 wrote to memory of 1772 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 35 PID 872 wrote to memory of 1772 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 35 PID 872 wrote to memory of 588 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 36 PID 872 wrote to memory of 588 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 36 PID 872 wrote to memory of 588 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 36 PID 872 wrote to memory of 588 872 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe"C:\Users\Admin\AppData\Local\Temp\df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe2⤵PID:1972
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe2⤵PID:1736
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe2⤵PID:1956
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe2⤵PID:1960
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe2⤵PID:1940
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe2⤵PID:1784
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe2⤵PID:1008
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe2⤵PID:1616
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe2⤵PID:1772
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe2⤵PID:588
-