Analysis
-
max time kernel
130s -
max time network
40s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
01-06-2022 16:41
Static task
static1
Behavioral task
behavioral1
Sample
windows_x64_encrypt.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
windows_x64_encrypt.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
windows_x64_encrypt.exe
-
Size
661KB
-
MD5
d2fab5d65d761b5efd229f0695e67011
-
SHA1
5480999819b359ed4f1ec284e74f8a33aa127915
-
SHA256
83ffbe63dd41a1a9d2d68fb1b72f6dffcf8e76ecefb8683ee47f6651f58b20a1
-
SHA512
dddd949221c9f1d5b425aaf4a026cec41205f78128e6b2a7aa94203c882903da87e4f5b052f36e5f9f4f91105554f86c0cf36d838c77948f438fbfda57934b3a
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
taskmgr.exepid Process 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid Process 1292 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
taskmgr.exeAUDIODG.EXEdescription pid Process Token: SeDebugPrivilege 1292 taskmgr.exe Token: 33 1448 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1448 AUDIODG.EXE Token: 33 1448 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1448 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid Process 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid Process 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\windows_x64_encrypt.exeC:\Users\Admin\AppData\Local\Temp\windows_x64_encrypt.exe -u test:test1⤵PID:1280
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:1896
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1292
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4081⤵
- Suspicious use of AdjustPrivilegeToken
PID:1448
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:1188