Analysis
-
max time kernel
150s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
07-06-2023 04:41
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20230220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
Setup.exe
-
Size
106KB
-
MD5
ba60d147d28d05bf07a9d65d31544c90
-
SHA1
91edd1e21a2131bf24fc4c5603867fd991cceee4
-
SHA256
6ae713e81d6cd0d299e4e72c7b7db6b42ab8f4747b4f5872c8a31cd886542c11
-
SHA512
ac890722f1945af1068fbc5940f2d2ef34ff0bf81f37bba902e022d58c38ba2ab8ad4a47a612ff487285d93bf08de387ab66f162516c03bec83398cfc1b14592
-
SSDEEP
1536:V0S+NhCmuhYwvXFmvM/n0Q1vOyHP1aed/y4YMv:V02muhR8OlvAed/nY
Score
8/10
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Setup.exepid process 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe 1192 Setup.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Setup.exepid process 1192 Setup.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
Setup.exedescription pid process Token: SeDebugPrivilege 1192 Setup.exe Token: 33 1192 Setup.exe Token: SeIncBasePriorityPrivilege 1192 Setup.exe Token: 33 1192 Setup.exe Token: SeIncBasePriorityPrivilege 1192 Setup.exe Token: 33 1192 Setup.exe Token: SeIncBasePriorityPrivilege 1192 Setup.exe Token: 33 1192 Setup.exe Token: SeIncBasePriorityPrivilege 1192 Setup.exe Token: 33 1192 Setup.exe Token: SeIncBasePriorityPrivilege 1192 Setup.exe Token: 33 1192 Setup.exe Token: SeIncBasePriorityPrivilege 1192 Setup.exe Token: 33 1192 Setup.exe Token: SeIncBasePriorityPrivilege 1192 Setup.exe Token: 33 1192 Setup.exe Token: SeIncBasePriorityPrivilege 1192 Setup.exe Token: 33 1192 Setup.exe Token: SeIncBasePriorityPrivilege 1192 Setup.exe Token: 33 1192 Setup.exe Token: SeIncBasePriorityPrivilege 1192 Setup.exe Token: 33 1192 Setup.exe Token: SeIncBasePriorityPrivilege 1192 Setup.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
Setup.exedescription pid process target process PID 1192 wrote to memory of 1980 1192 Setup.exe netsh.exe PID 1192 wrote to memory of 1980 1192 Setup.exe netsh.exe PID 1192 wrote to memory of 1980 1192 Setup.exe netsh.exe PID 1192 wrote to memory of 1980 1192 Setup.exe netsh.exe PID 1192 wrote to memory of 1980 1192 Setup.exe netsh.exe PID 1192 wrote to memory of 1980 1192 Setup.exe netsh.exe PID 1192 wrote to memory of 1980 1192 Setup.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Setup.exe" "Setup.exe" ENABLE2⤵
- Modifies Windows Firewall