Analysis
-
max time kernel
141s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
20/07/2023, 06:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
017f5780b4b0e6d97fb6f581ec3df8cb.exe
Resource
win7-20230712-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
017f5780b4b0e6d97fb6f581ec3df8cb.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
017f5780b4b0e6d97fb6f581ec3df8cb.exe
-
Size
6.4MB
-
MD5
017f5780b4b0e6d97fb6f581ec3df8cb
-
SHA1
01fdadc371bb2ca7585770763d7d8fad466e51a1
-
SHA256
4e99779daa53bffef62592a796d7fdc620ba3edc4f397d92343d3b89cb3a5e1a
-
SHA512
48af3edf0a7cfc946c2da34732f4e7c1079499508e3fec1e3f604585f2b6223a2e21c6beef6b1748d026621389c8d56e3ac63f096d6e93ebc61746b54b1fcdff
-
SSDEEP
196608:XPnQG14cH4xvtSsUEFXYjFxQzNhHR//9QK:XPfbYKsTxYjPQzjHc
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1880 set thread context of 4680 1880 017f5780b4b0e6d97fb6f581ec3df8cb.exe 93 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe 4680 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4680 InstallUtil.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1880 wrote to memory of 2372 1880 017f5780b4b0e6d97fb6f581ec3df8cb.exe 92 PID 1880 wrote to memory of 2372 1880 017f5780b4b0e6d97fb6f581ec3df8cb.exe 92 PID 1880 wrote to memory of 2372 1880 017f5780b4b0e6d97fb6f581ec3df8cb.exe 92 PID 1880 wrote to memory of 2372 1880 017f5780b4b0e6d97fb6f581ec3df8cb.exe 92 PID 1880 wrote to memory of 4680 1880 017f5780b4b0e6d97fb6f581ec3df8cb.exe 93 PID 1880 wrote to memory of 4680 1880 017f5780b4b0e6d97fb6f581ec3df8cb.exe 93 PID 1880 wrote to memory of 4680 1880 017f5780b4b0e6d97fb6f581ec3df8cb.exe 93 PID 1880 wrote to memory of 4680 1880 017f5780b4b0e6d97fb6f581ec3df8cb.exe 93 PID 1880 wrote to memory of 4680 1880 017f5780b4b0e6d97fb6f581ec3df8cb.exe 93 PID 1880 wrote to memory of 4680 1880 017f5780b4b0e6d97fb6f581ec3df8cb.exe 93 PID 1880 wrote to memory of 4680 1880 017f5780b4b0e6d97fb6f581ec3df8cb.exe 93 PID 1880 wrote to memory of 4680 1880 017f5780b4b0e6d97fb6f581ec3df8cb.exe 93 PID 1880 wrote to memory of 4680 1880 017f5780b4b0e6d97fb6f581ec3df8cb.exe 93 PID 1880 wrote to memory of 4680 1880 017f5780b4b0e6d97fb6f581ec3df8cb.exe 93 PID 1880 wrote to memory of 4680 1880 017f5780b4b0e6d97fb6f581ec3df8cb.exe 93 PID 1880 wrote to memory of 4680 1880 017f5780b4b0e6d97fb6f581ec3df8cb.exe 93 PID 1880 wrote to memory of 4680 1880 017f5780b4b0e6d97fb6f581ec3df8cb.exe 93 PID 1880 wrote to memory of 4680 1880 017f5780b4b0e6d97fb6f581ec3df8cb.exe 93 PID 1880 wrote to memory of 4680 1880 017f5780b4b0e6d97fb6f581ec3df8cb.exe 93 PID 1880 wrote to memory of 4680 1880 017f5780b4b0e6d97fb6f581ec3df8cb.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\017f5780b4b0e6d97fb6f581ec3df8cb.exe"C:\Users\Admin\AppData\Local\Temp\017f5780b4b0e6d97fb6f581ec3df8cb.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵PID:2372
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4680
-