Analysis
- max time kernel
148s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system - submitted
09/06/2023, 14:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
OUR REF RFQ 600066536 - PR 10023150.exe
Resource
win7-20230220-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
OUR REF RFQ 600066536 - PR 10023150.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target OUR REF RFQ 600066536 - PR 10023150.exe
- Size 656KB
- Sample230609-rwvxjsdb8w
- SHA256 607dcd836bd33a6d2afe6ef3c632468ef126eb49923409e246ba7ec86311c5a7
- MD5 14797c70f8e6515d5412b6d19f04851b
- SHA1 9cfb01a7f1fa2439f50ae28865741d10859042e3
- SHA512 e1ebc1ed9d5339e938deca4bbe4086746409d7d490259fe58280dacef9c10bce6e0f479016710fbaa99cb07f08c7f5f4d5e55866136c0a5b2746d20a2026f2f7
- SSDEEP 12288:PrGnmUAhgkCBU8kqiKpwPluNJJxT957M2VrRw61QwdF5CnKIBeVViEvKhX1F2FWj:o3vbC8QXKdiEvKhFFaW9x
- MD5 SHA1 SHA512 SSDEEP
Score
5/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 100 set thread context of 2152 100 OUR REF RFQ 600066536 - PR 10023150.exe 91 - Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 100 OUR REF RFQ 600066536 - PR 10023150.exe 100 OUR REF RFQ 600066536 - PR 10023150.exe 100 OUR REF RFQ 600066536 - PR 10023150.exe 100 OUR REF RFQ 600066536 - PR 10023150.exe 2152 RegSvcs.exe 2152 RegSvcs.exe 2152 RegSvcs.exe 2152 RegSvcs.exe 2152 RegSvcs.exe 2152 RegSvcs.exe 2152 RegSvcs.exe 2152 RegSvcs.exe 2152 RegSvcs.exe 2152 RegSvcs.exe 2152 RegSvcs.exe 2152 RegSvcs.exe 2152 RegSvcs.exe 2152 RegSvcs.exe 2152 RegSvcs.exe 2152 RegSvcs.exe 2152 RegSvcs.exe 2152 RegSvcs.exe 2152 RegSvcs.exe 2152 RegSvcs.exe 2152 RegSvcs.exe 2152 RegSvcs.exe 2152 RegSvcs.exe 2152 RegSvcs.exe 2152 RegSvcs.exe 2152 RegSvcs.exe 2152 RegSvcs.exe 2152 RegSvcs.exe 2152 RegSvcs.exe 2152 RegSvcs.exe 2152 RegSvcs.exe 2152 RegSvcs.exe 2152 RegSvcs.exe 2152 RegSvcs.exe 2152 RegSvcs.exe 2152 RegSvcs.exe 2152 RegSvcs.exe 2152 RegSvcs.exe 2152 RegSvcs.exe 2152 RegSvcs.exe 2152 RegSvcs.exe 2152 RegSvcs.exe 2152 RegSvcs.exe 2152 RegSvcs.exe 2152 RegSvcs.exe 2152 RegSvcs.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 100 OUR REF RFQ 600066536 - PR 10023150.exe Token: SeDebugPrivilege 2152 RegSvcs.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 100 wrote to memory of 1480 100 OUR REF RFQ 600066536 - PR 10023150.exe 90 PID 100 wrote to memory of 1480 100 OUR REF RFQ 600066536 - PR 10023150.exe 90 PID 100 wrote to memory of 1480 100 OUR REF RFQ 600066536 - PR 10023150.exe 90 PID 100 wrote to memory of 2152 100 OUR REF RFQ 600066536 - PR 10023150.exe 91 PID 100 wrote to memory of 2152 100 OUR REF RFQ 600066536 - PR 10023150.exe 91 PID 100 wrote to memory of 2152 100 OUR REF RFQ 600066536 - PR 10023150.exe 91 PID 100 wrote to memory of 2152 100 OUR REF RFQ 600066536 - PR 10023150.exe 91 PID 100 wrote to memory of 2152 100 OUR REF RFQ 600066536 - PR 10023150.exe 91 PID 100 wrote to memory of 2152 100 OUR REF RFQ 600066536 - PR 10023150.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\OUR REF RFQ 600066536 - PR 10023150.exe"C:\Users\Admin\AppData\Local\Temp\OUR REF RFQ 600066536 - PR 10023150.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:100 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:1480
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2152
-