Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
19/07/2023, 07:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a79a555d8074362ce42e03465fc6655d.exe
Resource
win7-20230712-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
a79a555d8074362ce42e03465fc6655d.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
a79a555d8074362ce42e03465fc6655d.exe
-
Size
951KB
-
MD5
a79a555d8074362ce42e03465fc6655d
-
SHA1
3acabb0dbb9d88b388e0b068c98c53605de367f0
-
SHA256
8904fe72b770215a4e3bc82f6e1fda9756a147fb86bdac2fec7ebac577866764
-
SHA512
57a1df140a146fd15c609adf98db46d578bfa8e0e05eaaeed287899fe83454860f055ba955575570af6652ebe948ee8eca4c3037dc5231ae2a9dfe94403fba83
-
SSDEEP
24576:Hk70TrczzmYJqlHIJYhO2VVP1ru6DGt1blxIj:HkQTAzztJcoKhOgVP1rjD417Ij
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5104 set thread context of 3180 5104 a79a555d8074362ce42e03465fc6655d.exe 84 -
Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe 3180 aspnet_compiler.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 5104 a79a555d8074362ce42e03465fc6655d.exe Token: SeDebugPrivilege 3180 aspnet_compiler.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5104 wrote to memory of 3180 5104 a79a555d8074362ce42e03465fc6655d.exe 84 PID 5104 wrote to memory of 3180 5104 a79a555d8074362ce42e03465fc6655d.exe 84 PID 5104 wrote to memory of 3180 5104 a79a555d8074362ce42e03465fc6655d.exe 84 PID 5104 wrote to memory of 3180 5104 a79a555d8074362ce42e03465fc6655d.exe 84 PID 5104 wrote to memory of 3180 5104 a79a555d8074362ce42e03465fc6655d.exe 84 PID 5104 wrote to memory of 3180 5104 a79a555d8074362ce42e03465fc6655d.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\a79a555d8074362ce42e03465fc6655d.exe"C:\Users\Admin\AppData\Local\Temp\a79a555d8074362ce42e03465fc6655d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3180
-