Analysis
-
max time kernel
36s -
max time network
41s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03-12-2022 06:45
Static task
static1
Behavioral task
behavioral1
Sample
SoftwareSetupFile.exe
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
SoftwareSetupFile.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
SoftwareSetupFile.exe
-
Size
2.5MB
-
MD5
7106bab16ae64b7f9bed1b90a2bbf03f
-
SHA1
ac6fae9627cf58654bc167bd63432111be9fd71e
-
SHA256
2a0e09e83a2f7198f6a9595d957dfcf0dcdf86a1c65ef4211c50eb15dd4ad598
-
SHA512
01cc49a5e6df8c6dfe197d4b638e60313b11f0efb016be29c457dc00ea5690c8d047c56cbff9f0c4a4a9c1b1b135dd2f7d2ccf4ca53856d398444d47368176e5
-
SSDEEP
24576:pI3cT50k2PYbtJcLQ/KpE2lcpZCyphghPUuZLxNjcFttg7qFCMSrOfBFJm4kazYc:E3qCs/AE2lhhsa1N8/FKeFJm4vAKjv
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 1720 SoftwareSetupFile.exe 1720 SoftwareSetupFile.exe 1720 SoftwareSetupFile.exe 1720 SoftwareSetupFile.exe 1720 SoftwareSetupFile.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1720 SoftwareSetupFile.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1720 SoftwareSetupFile.exe