Analysis
-
max time kernel
167s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2022, 21:54
Behavioral task
behavioral1
Sample
73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe
Resource
win7-20220901-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe
-
Size
25KB
-
MD5
01d95bf02a205024dc832c6927bbbf25
-
SHA1
25d0c631151eba384770e9a68f8e39e1636ce14a
-
SHA256
73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3
-
SHA512
9583328f4864ece27515fbf0a0ddcbbd2449ae7a21122a9b8cec5fae758c7c453940ca3ed1fa91e972a9f362c2337cb11a9ce3a6e7f83104afcf7b1e8864f64b
-
SSDEEP
768:yCvIa8UlNjMd3Npzu1XhhkyR7GOEJbGjWH:yCwNUtFh5iOE12WH
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4120-136-0x0000000010410000-0x0000000010427000-memory.dmp upx behavioral2/memory/4120-140-0x0000000000400000-0x0000000000417000-memory.dmp upx -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\userinit.exe 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe File created C:\Windows\SysWOW64\dllcache\userinit.exe 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe File created C:\Windows\SysWOW64\userinit.exe 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39 PID 4120 wrote to memory of 2596 4120 73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe 39
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe"C:\Users\Admin\AppData\Local\Temp\73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe"2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Windows\SysWOW64\cmd.execmd /c del "C:\Users\Admin\AppData\Local\Temp\73e7fd417562a4fe27ea92dcdfbc9e34b4c66a29b241f787378aa9c4e8553ed3.exe"3⤵PID:3736
-
-