Analysis
-
max time kernel
147s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 01:16
Static task
static1
Behavioral task
behavioral1
Sample
PO_2020130837727_288377233.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
PO_2020130837727_288377233.exe
Resource
win10v2004-20220414-en
General
-
Target
PO_2020130837727_288377233.exe
-
Size
974KB
-
MD5
b8802e4af1f4b8366521b4da418463a1
-
SHA1
81bd2b52b545f31b4a29c7749cd42db62ac672e4
-
SHA256
9810f656629ec1a2c0957a8d650b6caf1f9431e91c8a9516744636fbd39d54a8
-
SHA512
c78acdd6c6b73dbc7436e31b5c769311b2a3d9d43f253b661f9ee61486b8f63f7edefe95ecb638fe090f1f60682bc7efdd72a99e28f8e0946ede5ca7d0b03c5f
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO_2020130837727_288377233.exedescription pid process target process PID 2688 set thread context of 1528 2688 PO_2020130837727_288377233.exe PO_2020130837727_288377233.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
PO_2020130837727_288377233.exepowershell.exepid process 2688 PO_2020130837727_288377233.exe 2688 PO_2020130837727_288377233.exe 2688 PO_2020130837727_288377233.exe 3188 powershell.exe 3188 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PO_2020130837727_288377233.exepowershell.exedescription pid process Token: SeDebugPrivilege 2688 PO_2020130837727_288377233.exe Token: SeDebugPrivilege 3188 powershell.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
PO_2020130837727_288377233.exePO_2020130837727_288377233.execmd.exedescription pid process target process PID 2688 wrote to memory of 1528 2688 PO_2020130837727_288377233.exe PO_2020130837727_288377233.exe PID 2688 wrote to memory of 1528 2688 PO_2020130837727_288377233.exe PO_2020130837727_288377233.exe PID 2688 wrote to memory of 1528 2688 PO_2020130837727_288377233.exe PO_2020130837727_288377233.exe PID 2688 wrote to memory of 1528 2688 PO_2020130837727_288377233.exe PO_2020130837727_288377233.exe PID 2688 wrote to memory of 1528 2688 PO_2020130837727_288377233.exe PO_2020130837727_288377233.exe PID 2688 wrote to memory of 1528 2688 PO_2020130837727_288377233.exe PO_2020130837727_288377233.exe PID 2688 wrote to memory of 1528 2688 PO_2020130837727_288377233.exe PO_2020130837727_288377233.exe PID 2688 wrote to memory of 1528 2688 PO_2020130837727_288377233.exe PO_2020130837727_288377233.exe PID 1528 wrote to memory of 4184 1528 PO_2020130837727_288377233.exe cmd.exe PID 1528 wrote to memory of 4184 1528 PO_2020130837727_288377233.exe cmd.exe PID 1528 wrote to memory of 4184 1528 PO_2020130837727_288377233.exe cmd.exe PID 4184 wrote to memory of 3188 4184 cmd.exe powershell.exe PID 4184 wrote to memory of 3188 4184 cmd.exe powershell.exe PID 4184 wrote to memory of 3188 4184 cmd.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO_2020130837727_288377233.exe"C:\Users\Admin\AppData\Local\Temp\PO_2020130837727_288377233.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\PO_2020130837727_288377233.exe"{path}"2⤵
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\PO_2020130837727_288377233.exe' & exit3⤵
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\PO_2020130837727_288377233.exe'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3188
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58ec831f3e3a3f77e4a7b9cd32b48384c
SHA1d83f09fd87c5bd86e045873c231c14836e76a05c
SHA2567667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA51226bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3