Analysis
-
max time kernel
51s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 23:36
Static task
static1
Behavioral task
behavioral1
Sample
IMG1012020701.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
IMG1012020701.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
IMG10120207011.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
IMG10120207011.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
IMG10120207011.exe
-
Size
485KB
-
MD5
085d29006ec989b5938ddc78f78c72e9
-
SHA1
23859d85eb3f9ae83b61203f54318559e721ec50
-
SHA256
052bcc60e46315357188930ba35adce006f4e223a50c862db9795998d96faa30
-
SHA512
b32559895a12e809653c2ec4b05a9adee00a2a5c3c88f288241be01cd5607d553ba98d39736284f640ce54053247fd3d1e5457c9f7631aeba3efc8ab85621ab9
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
IMG10120207011.exepid process 1744 IMG10120207011.exe 1744 IMG10120207011.exe 1744 IMG10120207011.exe 1744 IMG10120207011.exe 1744 IMG10120207011.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
IMG10120207011.exedescription pid process Token: SeDebugPrivilege 1744 IMG10120207011.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
IMG10120207011.exedescription pid process target process PID 1744 wrote to memory of 1656 1744 IMG10120207011.exe IMG10120207011.exe PID 1744 wrote to memory of 1656 1744 IMG10120207011.exe IMG10120207011.exe PID 1744 wrote to memory of 1656 1744 IMG10120207011.exe IMG10120207011.exe PID 1744 wrote to memory of 1656 1744 IMG10120207011.exe IMG10120207011.exe PID 1744 wrote to memory of 968 1744 IMG10120207011.exe IMG10120207011.exe PID 1744 wrote to memory of 968 1744 IMG10120207011.exe IMG10120207011.exe PID 1744 wrote to memory of 968 1744 IMG10120207011.exe IMG10120207011.exe PID 1744 wrote to memory of 968 1744 IMG10120207011.exe IMG10120207011.exe PID 1744 wrote to memory of 952 1744 IMG10120207011.exe IMG10120207011.exe PID 1744 wrote to memory of 952 1744 IMG10120207011.exe IMG10120207011.exe PID 1744 wrote to memory of 952 1744 IMG10120207011.exe IMG10120207011.exe PID 1744 wrote to memory of 952 1744 IMG10120207011.exe IMG10120207011.exe PID 1744 wrote to memory of 1220 1744 IMG10120207011.exe IMG10120207011.exe PID 1744 wrote to memory of 1220 1744 IMG10120207011.exe IMG10120207011.exe PID 1744 wrote to memory of 1220 1744 IMG10120207011.exe IMG10120207011.exe PID 1744 wrote to memory of 1220 1744 IMG10120207011.exe IMG10120207011.exe PID 1744 wrote to memory of 1416 1744 IMG10120207011.exe IMG10120207011.exe PID 1744 wrote to memory of 1416 1744 IMG10120207011.exe IMG10120207011.exe PID 1744 wrote to memory of 1416 1744 IMG10120207011.exe IMG10120207011.exe PID 1744 wrote to memory of 1416 1744 IMG10120207011.exe IMG10120207011.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\IMG10120207011.exe"C:\Users\Admin\AppData\Local\Temp\IMG10120207011.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\IMG10120207011.exe"{path}"2⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\IMG10120207011.exe"{path}"2⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\IMG10120207011.exe"{path}"2⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\IMG10120207011.exe"{path}"2⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\IMG10120207011.exe"{path}"2⤵PID:1416