Analysis
-
max time kernel
8s -
max time network
42s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
24-11-2022 12:43
General
-
Target
2014_11informationen_finanzgruppe_000070002.000038622.771714407-0044.exe
-
Size
277KB
-
MD5
6f4d475eb0cb95a0bf8ab9825403253d
-
SHA1
b2f4bf05e102823c97b2a6a4b00c4183073d93a4
-
SHA256
cae0331cddf01777e3b1c275240b988c675527a4e9f72f91ffe4c0e8d68f73e4
-
SHA512
384ccff8f308e901bde57c65f76aa0f501019cb709b47c041fa1c234d81f77da08980b7c757b22a83ebafe720a3aa7d676528a988d2a3b35cb80f5a91f51382e
-
SSDEEP
6144:diaYUpwXV9RIKWn/TUVs8oL48N8lqFzc+tRJShtS:jzXrN8UbtPShI
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\2014_11informationen_finanzgruppe_000070002.000038622.771714407-0044.exe"C:\Users\Admin\AppData\Local\Temp\2014_11informationen_finanzgruppe_000070002.000038622.771714407-0044.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS1601~1.BAT"3⤵