Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
20-07-2023 06:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
017f5780b4b0e6d97fb6f581ec3df8cb.exe
Resource
win7-20230712-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
017f5780b4b0e6d97fb6f581ec3df8cb.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
017f5780b4b0e6d97fb6f581ec3df8cb.exe
-
Size
6.4MB
-
MD5
017f5780b4b0e6d97fb6f581ec3df8cb
-
SHA1
01fdadc371bb2ca7585770763d7d8fad466e51a1
-
SHA256
4e99779daa53bffef62592a796d7fdc620ba3edc4f397d92343d3b89cb3a5e1a
-
SHA512
48af3edf0a7cfc946c2da34732f4e7c1079499508e3fec1e3f604585f2b6223a2e21c6beef6b1748d026621389c8d56e3ac63f096d6e93ebc61746b54b1fcdff
-
SSDEEP
196608:XPnQG14cH4xvtSsUEFXYjFxQzNhHR//9QK:XPfbYKsTxYjPQzjHc
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2576 set thread context of 2596 2576 017f5780b4b0e6d97fb6f581ec3df8cb.exe 28 -
Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 2596 InstallUtil.exe 2596 InstallUtil.exe 2596 InstallUtil.exe 2596 InstallUtil.exe 2596 InstallUtil.exe 2596 InstallUtil.exe 2596 InstallUtil.exe 2596 InstallUtil.exe 2596 InstallUtil.exe 2596 InstallUtil.exe 2596 InstallUtil.exe 2596 InstallUtil.exe 2596 InstallUtil.exe 2596 InstallUtil.exe 2596 InstallUtil.exe 2596 InstallUtil.exe 2596 InstallUtil.exe 2596 InstallUtil.exe 2596 InstallUtil.exe 2596 InstallUtil.exe 2596 InstallUtil.exe 2596 InstallUtil.exe 2596 InstallUtil.exe 2596 InstallUtil.exe 2596 InstallUtil.exe 2596 InstallUtil.exe 2596 InstallUtil.exe 2596 InstallUtil.exe 2596 InstallUtil.exe 2596 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2596 InstallUtil.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2576 wrote to memory of 2596 2576 017f5780b4b0e6d97fb6f581ec3df8cb.exe 28 PID 2576 wrote to memory of 2596 2576 017f5780b4b0e6d97fb6f581ec3df8cb.exe 28 PID 2576 wrote to memory of 2596 2576 017f5780b4b0e6d97fb6f581ec3df8cb.exe 28 PID 2576 wrote to memory of 2596 2576 017f5780b4b0e6d97fb6f581ec3df8cb.exe 28 PID 2576 wrote to memory of 2596 2576 017f5780b4b0e6d97fb6f581ec3df8cb.exe 28 PID 2576 wrote to memory of 2596 2576 017f5780b4b0e6d97fb6f581ec3df8cb.exe 28 PID 2576 wrote to memory of 2596 2576 017f5780b4b0e6d97fb6f581ec3df8cb.exe 28 PID 2576 wrote to memory of 2596 2576 017f5780b4b0e6d97fb6f581ec3df8cb.exe 28 PID 2576 wrote to memory of 2596 2576 017f5780b4b0e6d97fb6f581ec3df8cb.exe 28 PID 2576 wrote to memory of 2596 2576 017f5780b4b0e6d97fb6f581ec3df8cb.exe 28 PID 2576 wrote to memory of 2596 2576 017f5780b4b0e6d97fb6f581ec3df8cb.exe 28 PID 2576 wrote to memory of 2596 2576 017f5780b4b0e6d97fb6f581ec3df8cb.exe 28 PID 2576 wrote to memory of 2596 2576 017f5780b4b0e6d97fb6f581ec3df8cb.exe 28 PID 2576 wrote to memory of 2596 2576 017f5780b4b0e6d97fb6f581ec3df8cb.exe 28 PID 2576 wrote to memory of 2596 2576 017f5780b4b0e6d97fb6f581ec3df8cb.exe 28 PID 2576 wrote to memory of 2596 2576 017f5780b4b0e6d97fb6f581ec3df8cb.exe 28 PID 2576 wrote to memory of 2596 2576 017f5780b4b0e6d97fb6f581ec3df8cb.exe 28 PID 2576 wrote to memory of 2596 2576 017f5780b4b0e6d97fb6f581ec3df8cb.exe 28 PID 2576 wrote to memory of 2596 2576 017f5780b4b0e6d97fb6f581ec3df8cb.exe 28 PID 2576 wrote to memory of 2596 2576 017f5780b4b0e6d97fb6f581ec3df8cb.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\017f5780b4b0e6d97fb6f581ec3df8cb.exe"C:\Users\Admin\AppData\Local\Temp\017f5780b4b0e6d97fb6f581ec3df8cb.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2596
-