Analysis
-
max time kernel
43s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
12-12-2022 10:31
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe
Resource
win7-20221111-en
3 signatures
150 seconds
General
-
Target
SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe
-
Size
921KB
-
MD5
930f9443825ac6382109d445a91fba74
-
SHA1
ae0bd1f64f7e972eae344bcfa1360081988e2842
-
SHA256
1fd55a441baa9459201847aa7aedb8262e45fac43f8f2f7fc09be53300c0f18b
-
SHA512
53183057a823ca1c21da988ad45efc69da2b009baf8ace0038f75d95a4c91853ff28f5570c08fe49758f5321337c1181dbbea391feac10d4f6cfff7594ca5991
-
SSDEEP
12288:l/iNXXD5lNRB65BcUQIVR6wseLkgPQei7zxux/u6tiKxXGG:R2lfKNfVR6wsIRPQZ7zUx/u6JgG
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exepid process 1400 SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe 1400 SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe 1400 SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe 1400 SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe 1400 SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exedescription pid process Token: SeDebugPrivilege 1400 SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exedescription pid process target process PID 1400 wrote to memory of 1916 1400 SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe PID 1400 wrote to memory of 1916 1400 SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe PID 1400 wrote to memory of 1916 1400 SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe PID 1400 wrote to memory of 1916 1400 SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe PID 1400 wrote to memory of 1524 1400 SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe PID 1400 wrote to memory of 1524 1400 SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe PID 1400 wrote to memory of 1524 1400 SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe PID 1400 wrote to memory of 1524 1400 SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe PID 1400 wrote to memory of 652 1400 SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe PID 1400 wrote to memory of 652 1400 SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe PID 1400 wrote to memory of 652 1400 SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe PID 1400 wrote to memory of 652 1400 SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe PID 1400 wrote to memory of 1368 1400 SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe PID 1400 wrote to memory of 1368 1400 SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe PID 1400 wrote to memory of 1368 1400 SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe PID 1400 wrote to memory of 1368 1400 SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe PID 1400 wrote to memory of 840 1400 SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe PID 1400 wrote to memory of 840 1400 SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe PID 1400 wrote to memory of 840 1400 SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe PID 1400 wrote to memory of 840 1400 SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.9744.4676.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1400-54-0x0000000000030000-0x000000000011C000-memory.dmpFilesize
944KB
-
memory/1400-55-0x00000000759F1000-0x00000000759F3000-memory.dmpFilesize
8KB
-
memory/1400-56-0x0000000000320000-0x000000000033A000-memory.dmpFilesize
104KB
-
memory/1400-57-0x0000000000530000-0x000000000053E000-memory.dmpFilesize
56KB
-
memory/1400-58-0x00000000057C0000-0x0000000005850000-memory.dmpFilesize
576KB
-
memory/1400-59-0x0000000005590000-0x00000000055E6000-memory.dmpFilesize
344KB