Analysis
-
max time kernel
44s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
19/09/2022, 21:54
Behavioral task
behavioral1
Sample
73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe
Resource
win7-20220901-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe
-
Size
25KB
-
MD5
01d95bf02a205024dc832c6927bbbf25
-
SHA1
25d0c631151eba384770e9a68f8e39e1636ce14a
-
SHA256
73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3
-
SHA512
9583328f4864ece27515fbf0a0ddcbbd2449ae7a21122a9b8cec5fae758c7c453940ca3ed1fa91e972a9f362c2337cb11a9ce3a6e7f83104afcf7b1e8864f64b
-
SSDEEP
768:yCvIa8UlNjMd3Npzu1XhhkyR7GOEJbGjWH:yCwNUtFh5iOE12WH
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2012-56-0x0000000010410000-0x0000000010427000-memory.dmp upx behavioral1/memory/2012-62-0x0000000000400000-0x0000000000417000-memory.dmp upx -
Deletes itself 1 IoCs
pid Process 2000 cmd.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\userinit.exe 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe File created C:\Windows\SysWOW64\dllcache\userinit.exe 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe File created C:\Windows\SysWOW64\userinit.exe 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12 PID 2012 wrote to memory of 1348 2012 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 12
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe"C:\Users\Admin\AppData\Local\Temp\73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe"2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\cmd.execmd /c del "C:\Users\Admin\AppData\Local\Temp\73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe"3⤵
- Deletes itself
PID:2000
-
-