Overview
overview
10Static
static
8©ɱ...08.exe
windows7-x64
1©ɱ...08.exe
windows10-2004-x64
1©ɱ...17.exe
windows7-x64
5©ɱ...17.exe
windows10-2004-x64
3©ɱ...20.exe
windows7-x64
3©ɱ...20.exe
windows10-2004-x64
1©ɱ...22.exe
windows7-x64
6©ɱ...22.exe
windows10-2004-x64
6©ɱ...40.exe
windows7-x64
5©ɱ...40.exe
windows10-2004-x64
5©ɱ...46.exe
windows7-x64
3©ɱ...46.exe
windows10-2004-x64
4©ɱ...53.exe
windows7-x64
6©ɱ...53.exe
windows10-2004-x64
6©ɱ...58.exe
windows7-x64
1©ɱ...58.exe
windows10-2004-x64
1©ɱ...77.exe
windows7-x64
3©ɱ...77.exe
windows10-2004-x64
3©ɱ...80.exe
windows7-x64
10©ɱ...80.exe
windows10-2004-x64
10©ɱ...83.exe
windows7-x64
8©ɱ...83.exe
windows10-2004-x64
8©ɱ...89.exe
windows7-x64
10©ɱ...89.exe
windows10-2004-x64
6©ɱ...93.exe
windows7-x64
1©ɱ...93.exe
windows10-2004-x64
1©ɱ...95.exe
windows7-x64
3©ɱ...95.exe
windows10-2004-x64
4©ɱ...98.exe
windows7-x64
10©ɱ...98.exe
windows10-2004-x64
6Analysis
-
max time kernel
23s -
max time network
84s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 09:08
Behavioral task
behavioral1
Sample
©ɱ/008.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
©ɱ/008.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
©ɱ/017.exe
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
©ɱ/017.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
©ɱ/020.exe
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
©ɱ/020.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral7
Sample
©ɱ/022.exe
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
©ɱ/022.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
©ɱ/040.exe
Resource
win7-20221111-en
Behavioral task
behavioral10
Sample
©ɱ/040.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral11
Sample
©ɱ/046.exe
Resource
win7-20221111-en
Behavioral task
behavioral12
Sample
©ɱ/046.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral13
Sample
©ɱ/053.exe
Resource
win7-20221111-en
Behavioral task
behavioral14
Sample
©ɱ/053.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral15
Sample
©ɱ/058.exe
Resource
win7-20220901-en
Behavioral task
behavioral16
Sample
©ɱ/058.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral17
Sample
©ɱ/077.exe
Resource
win7-20220812-en
Behavioral task
behavioral18
Sample
©ɱ/077.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
©ɱ/080.exe
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
©ɱ/080.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
©ɱ/083.exe
Resource
win7-20220901-en
Behavioral task
behavioral22
Sample
©ɱ/083.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral23
Sample
©ɱ/089.exe
Resource
win7-20220812-en
Behavioral task
behavioral24
Sample
©ɱ/089.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral25
Sample
©ɱ/093.exe
Resource
win7-20220812-en
Behavioral task
behavioral26
Sample
©ɱ/093.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral27
Sample
©ɱ/095.exe
Resource
win7-20221111-en
Behavioral task
behavioral28
Sample
©ɱ/095.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral29
Sample
©ɱ/098.exe
Resource
win7-20220901-en
Behavioral task
behavioral30
Sample
©ɱ/098.exe
Resource
win10v2004-20221111-en
General
-
Target
©ɱ/089.exe
-
Size
92KB
-
MD5
51c7d3f4106b5557f9bdfaab4267be80
-
SHA1
b5fc281eb69f928836b87a368c75a463d0e98c32
-
SHA256
9e8daaef763f7ba248c473550d75ec675fa789ed61ac8796dd5357d928fcccad
-
SHA512
c800da51283853f39c1a2498e9d6395c38afe81dedfd0fdb25e33cba8ef50b4897e084924ae7b6a2f864c4cb4456c470c372e01f2333d80336ac3fa9491a35c8
-
SSDEEP
768:PpOOOgbxjhv+ZddsrCnDXn2tPIlnXOREbGnFkHjbGyrIMWG5ErjS:PpOOOiGZHkCDG1SmF2jbxWGq6
Malware Config
Signatures
-
Processes:
089.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 089.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
089.exepid process 1964 089.exe 1964 089.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
089.exedescription pid process Token: SeDebugPrivilege 1964 089.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
089.exedescription pid process target process PID 1964 wrote to memory of 3468 1964 089.exe svchost.exe PID 1964 wrote to memory of 3468 1964 089.exe svchost.exe PID 1964 wrote to memory of 3468 1964 089.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\©ɱ\089.exe"C:\Users\Admin\AppData\Local\Temp\©ɱ\089.exe"1⤵
- Checks whether UAC is enabled
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵