Analysis
-
max time kernel
59s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 22:31
Static task
static1
Behavioral task
behavioral1
Sample
ADHOC RFQ-97571784.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
ADHOC RFQ-97571784.exe
-
Size
752KB
-
MD5
3b6a5dff660d98b9bf28fcd5d405f730
-
SHA1
ff5edd294f28d909cdc7bda80d2c9cdb217684f0
-
SHA256
3cb6e41efa5dff6ef7957b9ae07c6b47f2ec35bc88889424d83ca3e96bcf3922
-
SHA512
3b031fbbbd6921659bd8ca68e50870128cb9e938552b72386c70a7288bf6b03a655da514f033f89d8a461019f8b54deb79a4a6c162989a052bdee81b5273fcee
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
ADHOC RFQ-97571784.exepid process 1516 ADHOC RFQ-97571784.exe 1516 ADHOC RFQ-97571784.exe 1516 ADHOC RFQ-97571784.exe 1516 ADHOC RFQ-97571784.exe 1516 ADHOC RFQ-97571784.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ADHOC RFQ-97571784.exedescription pid process Token: SeDebugPrivilege 1516 ADHOC RFQ-97571784.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
ADHOC RFQ-97571784.exedescription pid process target process PID 1516 wrote to memory of 960 1516 ADHOC RFQ-97571784.exe ADHOC RFQ-97571784.exe PID 1516 wrote to memory of 960 1516 ADHOC RFQ-97571784.exe ADHOC RFQ-97571784.exe PID 1516 wrote to memory of 960 1516 ADHOC RFQ-97571784.exe ADHOC RFQ-97571784.exe PID 1516 wrote to memory of 960 1516 ADHOC RFQ-97571784.exe ADHOC RFQ-97571784.exe PID 1516 wrote to memory of 1804 1516 ADHOC RFQ-97571784.exe ADHOC RFQ-97571784.exe PID 1516 wrote to memory of 1804 1516 ADHOC RFQ-97571784.exe ADHOC RFQ-97571784.exe PID 1516 wrote to memory of 1804 1516 ADHOC RFQ-97571784.exe ADHOC RFQ-97571784.exe PID 1516 wrote to memory of 1804 1516 ADHOC RFQ-97571784.exe ADHOC RFQ-97571784.exe PID 1516 wrote to memory of 1476 1516 ADHOC RFQ-97571784.exe ADHOC RFQ-97571784.exe PID 1516 wrote to memory of 1476 1516 ADHOC RFQ-97571784.exe ADHOC RFQ-97571784.exe PID 1516 wrote to memory of 1476 1516 ADHOC RFQ-97571784.exe ADHOC RFQ-97571784.exe PID 1516 wrote to memory of 1476 1516 ADHOC RFQ-97571784.exe ADHOC RFQ-97571784.exe PID 1516 wrote to memory of 1128 1516 ADHOC RFQ-97571784.exe ADHOC RFQ-97571784.exe PID 1516 wrote to memory of 1128 1516 ADHOC RFQ-97571784.exe ADHOC RFQ-97571784.exe PID 1516 wrote to memory of 1128 1516 ADHOC RFQ-97571784.exe ADHOC RFQ-97571784.exe PID 1516 wrote to memory of 1128 1516 ADHOC RFQ-97571784.exe ADHOC RFQ-97571784.exe PID 1516 wrote to memory of 1216 1516 ADHOC RFQ-97571784.exe ADHOC RFQ-97571784.exe PID 1516 wrote to memory of 1216 1516 ADHOC RFQ-97571784.exe ADHOC RFQ-97571784.exe PID 1516 wrote to memory of 1216 1516 ADHOC RFQ-97571784.exe ADHOC RFQ-97571784.exe PID 1516 wrote to memory of 1216 1516 ADHOC RFQ-97571784.exe ADHOC RFQ-97571784.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ADHOC RFQ-97571784.exe"C:\Users\Admin\AppData\Local\Temp\ADHOC RFQ-97571784.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ADHOC RFQ-97571784.exe"C:\Users\Admin\AppData\Local\Temp\ADHOC RFQ-97571784.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\ADHOC RFQ-97571784.exe"C:\Users\Admin\AppData\Local\Temp\ADHOC RFQ-97571784.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\ADHOC RFQ-97571784.exe"C:\Users\Admin\AppData\Local\Temp\ADHOC RFQ-97571784.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\ADHOC RFQ-97571784.exe"C:\Users\Admin\AppData\Local\Temp\ADHOC RFQ-97571784.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\ADHOC RFQ-97571784.exe"C:\Users\Admin\AppData\Local\Temp\ADHOC RFQ-97571784.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1516-54-0x00000000002E0000-0x00000000003A4000-memory.dmpFilesize
784KB
-
memory/1516-55-0x00000000755A1000-0x00000000755A3000-memory.dmpFilesize
8KB
-
memory/1516-56-0x00000000005C0000-0x00000000005C8000-memory.dmpFilesize
32KB
-
memory/1516-57-0x0000000004FC0000-0x000000000503C000-memory.dmpFilesize
496KB
-
memory/1516-58-0x00000000053A0000-0x0000000005422000-memory.dmpFilesize
520KB