Analysis
-
max time kernel
113s -
max time network
116s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
10/10/2022, 16:35
Behavioral task
behavioral1
Sample
ZX2.exe
Resource
win7-20220812-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
ZX2.exe
Resource
win10v2004-20220901-en
2 signatures
150 seconds
General
-
Target
ZX2.exe
-
Size
32KB
-
MD5
75ead756b5bcc18d72076216622742c5
-
SHA1
72e8cdb401cf395f0461a51939f2bebff5aa2a51
-
SHA256
cbc4c00395ee3d24d1f5a1dd64cfb0b74648f0371a0665287dd8108181e7668b
-
SHA512
c3ae2438d96d639bb890eca0a1da4a189ce3330561103382ea1418e836b77069c0bf5b7a2239a6615b80eab507347e6571279031d42f5e5e038fd4951cdcf790
-
SSDEEP
384:V0bUe5XB4e0XlOVoc6WQzDWTktTUFQqz9QObbO:2T9Bu8ucrQV6bO
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeDebugPrivilege 1948 ZX2.exe Token: 33 1948 ZX2.exe Token: SeIncBasePriorityPrivilege 1948 ZX2.exe Token: 33 1948 ZX2.exe Token: SeIncBasePriorityPrivilege 1948 ZX2.exe Token: 33 1948 ZX2.exe Token: SeIncBasePriorityPrivilege 1948 ZX2.exe Token: 33 1948 ZX2.exe Token: SeIncBasePriorityPrivilege 1948 ZX2.exe Token: 33 1948 ZX2.exe Token: SeIncBasePriorityPrivilege 1948 ZX2.exe Token: 33 1948 ZX2.exe Token: SeIncBasePriorityPrivilege 1948 ZX2.exe Token: 33 1948 ZX2.exe Token: SeIncBasePriorityPrivilege 1948 ZX2.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1948 wrote to memory of 1196 1948 ZX2.exe 28 PID 1948 wrote to memory of 1196 1948 ZX2.exe 28 PID 1948 wrote to memory of 1196 1948 ZX2.exe 28 PID 1948 wrote to memory of 1196 1948 ZX2.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\ZX2.exe"C:\Users\Admin\AppData\Local\Temp\ZX2.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\cmd.execmd.exe /C Y /N /D Y /T 1 & Del "C:\Users\Admin\AppData\Local\Temp\ZX2.exe"2⤵PID:1196
-