Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
11-10-2023 09:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
recordatori...242146238.exe
Resource
win7-20230831-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
recordatori...242146238.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
recordatori...242146238.exe
-
Size
569KB
-
MD5
ceef1b2842c9b7d4d229628cc26d2566
-
SHA1
f28ee10848e9d2fc0be3a5d296622ff292bcb5c6
-
SHA256
b574d17071016f07f3485f62a3ada8e8557eaa3b21a32fe52e6e52be8cc7b2c1
-
SHA512
8dd4e9e9a6c44cc526bf9b3e3662e59206bc93f8e35f030312791b2b35e2c333eeb6e41f837dfe1ffd93f38cea4076a0c011855432093d49fdc18d893090fc5b
-
SSDEEP
12288:X2iN4yiRJU/WcDxL2ZCUWgxSwITM1iobNA1m2cHSDkAYb:X19FecxLxWcoRGm2U
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
recordatori...242146238.exepowershell.exepid process 1716 recordatori...242146238.exe 1716 recordatori...242146238.exe 1716 recordatori...242146238.exe 1716 recordatori...242146238.exe 1716 recordatori...242146238.exe 1716 recordatori...242146238.exe 1716 recordatori...242146238.exe 1716 recordatori...242146238.exe 1716 recordatori...242146238.exe 1716 recordatori...242146238.exe 1340 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
recordatori...242146238.exepowershell.exedescription pid process Token: SeDebugPrivilege 1716 recordatori...242146238.exe Token: SeDebugPrivilege 1340 powershell.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
recordatori...242146238.exedescription pid process target process PID 1716 wrote to memory of 1340 1716 recordatori...242146238.exe powershell.exe PID 1716 wrote to memory of 1340 1716 recordatori...242146238.exe powershell.exe PID 1716 wrote to memory of 1340 1716 recordatori...242146238.exe powershell.exe PID 1716 wrote to memory of 1340 1716 recordatori...242146238.exe powershell.exe PID 1716 wrote to memory of 2688 1716 recordatori...242146238.exe recordatori...242146238.exe PID 1716 wrote to memory of 2688 1716 recordatori...242146238.exe recordatori...242146238.exe PID 1716 wrote to memory of 2688 1716 recordatori...242146238.exe recordatori...242146238.exe PID 1716 wrote to memory of 2688 1716 recordatori...242146238.exe recordatori...242146238.exe PID 1716 wrote to memory of 2028 1716 recordatori...242146238.exe recordatori...242146238.exe PID 1716 wrote to memory of 2028 1716 recordatori...242146238.exe recordatori...242146238.exe PID 1716 wrote to memory of 2028 1716 recordatori...242146238.exe recordatori...242146238.exe PID 1716 wrote to memory of 2028 1716 recordatori...242146238.exe recordatori...242146238.exe PID 1716 wrote to memory of 2620 1716 recordatori...242146238.exe recordatori...242146238.exe PID 1716 wrote to memory of 2620 1716 recordatori...242146238.exe recordatori...242146238.exe PID 1716 wrote to memory of 2620 1716 recordatori...242146238.exe recordatori...242146238.exe PID 1716 wrote to memory of 2620 1716 recordatori...242146238.exe recordatori...242146238.exe PID 1716 wrote to memory of 2480 1716 recordatori...242146238.exe recordatori...242146238.exe PID 1716 wrote to memory of 2480 1716 recordatori...242146238.exe recordatori...242146238.exe PID 1716 wrote to memory of 2480 1716 recordatori...242146238.exe recordatori...242146238.exe PID 1716 wrote to memory of 2480 1716 recordatori...242146238.exe recordatori...242146238.exe PID 1716 wrote to memory of 2792 1716 recordatori...242146238.exe recordatori...242146238.exe PID 1716 wrote to memory of 2792 1716 recordatori...242146238.exe recordatori...242146238.exe PID 1716 wrote to memory of 2792 1716 recordatori...242146238.exe recordatori...242146238.exe PID 1716 wrote to memory of 2792 1716 recordatori...242146238.exe recordatori...242146238.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\recordatori...242146238.exe"C:\Users\Admin\AppData\Local\Temp\recordatori...242146238.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\recordatori...242146238.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\recordatori...242146238.exe"C:\Users\Admin\AppData\Local\Temp\recordatori...242146238.exe"2⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\recordatori...242146238.exe"C:\Users\Admin\AppData\Local\Temp\recordatori...242146238.exe"2⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\recordatori...242146238.exe"C:\Users\Admin\AppData\Local\Temp\recordatori...242146238.exe"2⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\recordatori...242146238.exe"C:\Users\Admin\AppData\Local\Temp\recordatori...242146238.exe"2⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\recordatori...242146238.exe"C:\Users\Admin\AppData\Local\Temp\recordatori...242146238.exe"2⤵PID:2792