Analysis
-
max time kernel
20s -
max time network
35s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
31-01-2023 07:01
Static task
static1
Behavioral task
behavioral1
Sample
setupsoftapp19.0.exe
Resource
win7-20221111-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
setupsoftapp19.0.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
setupsoftapp19.0.exe
-
Size
762.9MB
-
MD5
17aaa592f0b1bd973f5f66a4dfa728dc
-
SHA1
31f91c8e2349ebd94ab4170f856d7ca6b65b4143
-
SHA256
e96809c130f1387f78a72e0ad4280a13aa10223aaacb3388cf3e8971e2b14c86
-
SHA512
565c4dff550206ffac85e9e9482b00d8859c79208889b9bd7741530d218c18576b41a5fbba08513595e3ae9bb351d66a775fa99c0cc2522af7551af2e1fe0a32
-
SSDEEP
98304:SIAzUE2bRCunvAdP4lLBYHHm/+MJXzdG7cLwE0xYhrRx4S/HzL71hY:SIKU4uodQjAUJxG7c0EIYJ/4S/TL70
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
setupsoftapp19.0.exepid process 1772 setupsoftapp19.0.exe 1772 setupsoftapp19.0.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
setupsoftapp19.0.exedescription pid process Token: SeDebugPrivilege 1772 setupsoftapp19.0.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
setupsoftapp19.0.exedescription pid process target process PID 1772 wrote to memory of 992 1772 setupsoftapp19.0.exe InstallUtil.exe PID 1772 wrote to memory of 992 1772 setupsoftapp19.0.exe InstallUtil.exe PID 1772 wrote to memory of 992 1772 setupsoftapp19.0.exe InstallUtil.exe PID 1772 wrote to memory of 992 1772 setupsoftapp19.0.exe InstallUtil.exe PID 1772 wrote to memory of 992 1772 setupsoftapp19.0.exe InstallUtil.exe PID 1772 wrote to memory of 992 1772 setupsoftapp19.0.exe InstallUtil.exe PID 1772 wrote to memory of 992 1772 setupsoftapp19.0.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\setupsoftapp19.0.exe"C:\Users\Admin\AppData\Local\Temp\setupsoftapp19.0.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe"2⤵