Analysis
-
max time kernel
150s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
02/06/2023, 13:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230220-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
file.exe
-
Size
448KB
-
MD5
be358067055b8823e303b387d3f73b20
-
SHA1
2d2bfcbc050ccee73253447ef5e97a50f242952a
-
SHA256
842742f5d07358e45cd7f7011bc60ad1376e88b860a0c0cd37d132d4aa0b83bc
-
SHA512
76c7735272264d8e8a4c694134f2fc70024832bc7c1ecc7566e7477e467c4f44e4ae725567cef57455828a5ff60f03fa871fbac6820d7062f51f0b96149a7642
-
SSDEEP
6144:KVPx0NQtuXSlou6vWiRjz+8DPJQNZKI8lH0kKS81UdD0JGeF7lyHatdIEii0g7Oc:K1dtuXSldr6bDQZ8s+A/sBEiy7OqF6v6
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1992 set thread context of 1388 1992 file.exe 32 -
Suspicious behavior: EnumeratesProcesses 36 IoCs
pid Process 1992 file.exe 1992 file.exe 1992 file.exe 1992 file.exe 1992 file.exe 1388 SetupUtility.exe 1388 SetupUtility.exe 1388 SetupUtility.exe 1388 SetupUtility.exe 1388 SetupUtility.exe 1388 SetupUtility.exe 1388 SetupUtility.exe 1388 SetupUtility.exe 1388 SetupUtility.exe 1388 SetupUtility.exe 1388 SetupUtility.exe 1388 SetupUtility.exe 1388 SetupUtility.exe 1388 SetupUtility.exe 1388 SetupUtility.exe 1388 SetupUtility.exe 1388 SetupUtility.exe 1388 SetupUtility.exe 1388 SetupUtility.exe 1388 SetupUtility.exe 1388 SetupUtility.exe 1388 SetupUtility.exe 1388 SetupUtility.exe 1388 SetupUtility.exe 1388 SetupUtility.exe 1388 SetupUtility.exe 1388 SetupUtility.exe 1388 SetupUtility.exe 1388 SetupUtility.exe 1388 SetupUtility.exe 1388 SetupUtility.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1992 file.exe Token: SeDebugPrivilege 1388 SetupUtility.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 1992 wrote to memory of 1976 1992 file.exe 27 PID 1992 wrote to memory of 1976 1992 file.exe 27 PID 1992 wrote to memory of 1976 1992 file.exe 27 PID 1992 wrote to memory of 1980 1992 file.exe 28 PID 1992 wrote to memory of 1980 1992 file.exe 28 PID 1992 wrote to memory of 1980 1992 file.exe 28 PID 1992 wrote to memory of 1192 1992 file.exe 29 PID 1992 wrote to memory of 1192 1992 file.exe 29 PID 1992 wrote to memory of 1192 1992 file.exe 29 PID 1992 wrote to memory of 1832 1992 file.exe 30 PID 1992 wrote to memory of 1832 1992 file.exe 30 PID 1992 wrote to memory of 1832 1992 file.exe 30 PID 1992 wrote to memory of 696 1992 file.exe 31 PID 1992 wrote to memory of 696 1992 file.exe 31 PID 1992 wrote to memory of 696 1992 file.exe 31 PID 1992 wrote to memory of 1388 1992 file.exe 32 PID 1992 wrote to memory of 1388 1992 file.exe 32 PID 1992 wrote to memory of 1388 1992 file.exe 32 PID 1992 wrote to memory of 1388 1992 file.exe 32 PID 1992 wrote to memory of 1388 1992 file.exe 32 PID 1992 wrote to memory of 1388 1992 file.exe 32 PID 1992 wrote to memory of 1388 1992 file.exe 32 PID 1992 wrote to memory of 1388 1992 file.exe 32 PID 1992 wrote to memory of 1388 1992 file.exe 32 PID 1992 wrote to memory of 1388 1992 file.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"2⤵PID:1976
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe"2⤵PID:1980
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"2⤵PID:1192
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"2⤵PID:1832
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"2⤵PID:696
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1388
-