Analysis
-
max time kernel
112s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
10/10/2022, 16:35
Behavioral task
behavioral1
Sample
ZX2.exe
Resource
win7-20220812-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
ZX2.exe
Resource
win10v2004-20220901-en
2 signatures
150 seconds
General
-
Target
ZX2.exe
-
Size
32KB
-
MD5
75ead756b5bcc18d72076216622742c5
-
SHA1
72e8cdb401cf395f0461a51939f2bebff5aa2a51
-
SHA256
cbc4c00395ee3d24d1f5a1dd64cfb0b74648f0371a0665287dd8108181e7668b
-
SHA512
c3ae2438d96d639bb890eca0a1da4a189ce3330561103382ea1418e836b77069c0bf5b7a2239a6615b80eab507347e6571279031d42f5e5e038fd4951cdcf790
-
SSDEEP
384:V0bUe5XB4e0XlOVoc6WQzDWTktTUFQqz9QObbO:2T9Bu8ucrQV6bO
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 27 IoCs
description pid Process Token: SeDebugPrivilege 372 ZX2.exe Token: 33 372 ZX2.exe Token: SeIncBasePriorityPrivilege 372 ZX2.exe Token: 33 372 ZX2.exe Token: SeIncBasePriorityPrivilege 372 ZX2.exe Token: 33 372 ZX2.exe Token: SeIncBasePriorityPrivilege 372 ZX2.exe Token: 33 372 ZX2.exe Token: SeIncBasePriorityPrivilege 372 ZX2.exe Token: 33 372 ZX2.exe Token: SeIncBasePriorityPrivilege 372 ZX2.exe Token: 33 372 ZX2.exe Token: SeIncBasePriorityPrivilege 372 ZX2.exe Token: 33 372 ZX2.exe Token: SeIncBasePriorityPrivilege 372 ZX2.exe Token: 33 372 ZX2.exe Token: SeIncBasePriorityPrivilege 372 ZX2.exe Token: 33 372 ZX2.exe Token: SeIncBasePriorityPrivilege 372 ZX2.exe Token: 33 372 ZX2.exe Token: SeIncBasePriorityPrivilege 372 ZX2.exe Token: 33 372 ZX2.exe Token: SeIncBasePriorityPrivilege 372 ZX2.exe Token: 33 372 ZX2.exe Token: SeIncBasePriorityPrivilege 372 ZX2.exe Token: 33 372 ZX2.exe Token: SeIncBasePriorityPrivilege 372 ZX2.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 372 wrote to memory of 2848 372 ZX2.exe 89 PID 372 wrote to memory of 2848 372 ZX2.exe 89 PID 372 wrote to memory of 2848 372 ZX2.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\ZX2.exe"C:\Users\Admin\AppData\Local\Temp\ZX2.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Windows\SysWOW64\cmd.execmd.exe /C Y /N /D Y /T 1 & Del "C:\Users\Admin\AppData\Local\Temp\ZX2.exe"2⤵PID:2848
-