Analysis
-
max time kernel
45s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 11:13
Static task
static1
Behavioral task
behavioral1
Sample
130003150.exe
Resource
win7-20220414-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
130003150.exe
Resource
win10v2004-20220414-en
0 signatures
0 seconds
General
-
Target
130003150.exe
-
Size
660KB
-
MD5
7a968158b9741fc52607f73b6f2a3d60
-
SHA1
08cb17546a07ebbee90681447061411efc492229
-
SHA256
c54cf445744aefec5a42006354295fd7b1adff5ba3c5d4906f7df4fa4a4076eb
-
SHA512
95892aa575bbf19f1b8da6b1d08c274cf93e6b8e2fdd318443427351a0fbac4af814192e13cac9e935a94e6e61c176019767c81b2f9aa12caea55485494c9b1c
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
130003150.exepid process 1420 130003150.exe 1420 130003150.exe 1420 130003150.exe 1420 130003150.exe 1420 130003150.exe 1420 130003150.exe 1420 130003150.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
130003150.exedescription pid process Token: SeDebugPrivilege 1420 130003150.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
130003150.exedescription pid process target process PID 1420 wrote to memory of 1772 1420 130003150.exe 130003150.exe PID 1420 wrote to memory of 1772 1420 130003150.exe 130003150.exe PID 1420 wrote to memory of 1772 1420 130003150.exe 130003150.exe PID 1420 wrote to memory of 1772 1420 130003150.exe 130003150.exe PID 1420 wrote to memory of 1096 1420 130003150.exe 130003150.exe PID 1420 wrote to memory of 1096 1420 130003150.exe 130003150.exe PID 1420 wrote to memory of 1096 1420 130003150.exe 130003150.exe PID 1420 wrote to memory of 1096 1420 130003150.exe 130003150.exe PID 1420 wrote to memory of 840 1420 130003150.exe 130003150.exe PID 1420 wrote to memory of 840 1420 130003150.exe 130003150.exe PID 1420 wrote to memory of 840 1420 130003150.exe 130003150.exe PID 1420 wrote to memory of 840 1420 130003150.exe 130003150.exe PID 1420 wrote to memory of 1264 1420 130003150.exe 130003150.exe PID 1420 wrote to memory of 1264 1420 130003150.exe 130003150.exe PID 1420 wrote to memory of 1264 1420 130003150.exe 130003150.exe PID 1420 wrote to memory of 1264 1420 130003150.exe 130003150.exe PID 1420 wrote to memory of 1784 1420 130003150.exe 130003150.exe PID 1420 wrote to memory of 1784 1420 130003150.exe 130003150.exe PID 1420 wrote to memory of 1784 1420 130003150.exe 130003150.exe PID 1420 wrote to memory of 1784 1420 130003150.exe 130003150.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\130003150.exe"C:\Users\Admin\AppData\Local\Temp\130003150.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\130003150.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\130003150.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\130003150.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\130003150.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\130003150.exe"{path}"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1420-54-0x00000000003B0000-0x000000000045C000-memory.dmpFilesize
688KB
-
memory/1420-55-0x00000000752B1000-0x00000000752B3000-memory.dmpFilesize
8KB
-
memory/1420-56-0x00000000004F0000-0x00000000004FA000-memory.dmpFilesize
40KB
-
memory/1420-57-0x0000000000600000-0x000000000068E000-memory.dmpFilesize
568KB
-
memory/1420-58-0x00000000073E0000-0x0000000007462000-memory.dmpFilesize
520KB