Analysis
-
max time kernel
41s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 16:32
Static task
static1
Behavioral task
behavioral1
Sample
WPE/W-P-E.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
WPE/W-P-E.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
WPE/WpASpy.dll
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
WPE/WpASpy.dll
Resource
win10v2004-20220812-en
General
-
Target
WPE/W-P-E.exe
-
Size
951KB
-
MD5
de2728f4917c8ef287f1cc0b9f4d1ac7
-
SHA1
07a511fffc8081eb87076529f84a48572e874315
-
SHA256
55c93531a44b6f6b68ae0fdf73a95f074f86b47bd66b40b351a3da04f59e0b10
-
SHA512
71bab7f145a688ae882185bd3e491ac3e90ad75253ba4f20bf6c1016bf63a0f46320bf486e35bdcbff7d3d0d49c6f46d1b9383bdbebc632d4ebee6cf9326d81c
-
SSDEEP
12288:e3v6sgx8iIivBmxWb30XJe4s1lPSOCx8zmRaar5kuHer2zHjaJsg1zvG:e/6tIu3Ujs1VDCx3GuDU1C
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
W-P-E.exedescription pid process Token: SeDebugPrivilege 1412 W-P-E.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
W-P-E.exepid process 1412 W-P-E.exe 1412 W-P-E.exe 1412 W-P-E.exe 1412 W-P-E.exe