Analysis
-
max time kernel
63s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
15-08-2022 20:52
Behavioral task
behavioral1
Sample
InstallUtil.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
InstallUtil.exe
Resource
win10-20220812-en
windows10-1703-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
InstallUtil.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
InstallUtil.exe
-
Size
596KB
-
MD5
112f944b3c6f80dd99efd3d3da60d16a
-
SHA1
72d7b61060fc7d67c7bd6b5546bc40bf573b8dc7
-
SHA256
b2f57cb17dbb818945da02b099575625b904c4732f54ffd91560b95f72d95160
-
SHA512
ae0f6139d0eb445e1854cbb533a734e229c9ed5cec57434d8fbd526930b85fa732930bc9164ca3f336625f5fdb32f44d93a822dffc688acce8a92ae8825c5c7a
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1304 taskmgr.exe -
Suspicious use of FindShellTrayWindow 32 IoCs
pid Process 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe 1304 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 380 InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:380
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1304