Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
11/10/2023, 18:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
rOrderRequirements-Invoice.exe
Resource
win7-20230831-en
3 signatures
150 seconds
General
-
Target
rOrderRequirements-Invoice.exe
-
Size
806KB
-
MD5
aa79e4458fd7f7be6b044281984dc3cf
-
SHA1
4fa6041b430c958e4c403c3f140783cf1ad05c79
-
SHA256
716cc459f4685123823a8e5fc94768b3526c0900c98a0e51c5ce4b794b6b9f8c
-
SHA512
a9dbe8065515bf06455179cf8c965d94d0f7f7ad83c82f84807e526cea8b07798bc5543b184f609f48290b4784f114f3f8a1b416ff6a977d097f2e3d202def2a
-
SSDEEP
24576:IyFdolEMsxb+zqFPoBmjvZIKiUnmOU5uQn:IGYEMsxb+zqJemjvFmOk
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2636 rOrderRequirements-Invoice.exe 2636 rOrderRequirements-Invoice.exe 2636 rOrderRequirements-Invoice.exe 2636 rOrderRequirements-Invoice.exe 2636 rOrderRequirements-Invoice.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2636 rOrderRequirements-Invoice.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2636 wrote to memory of 2624 2636 rOrderRequirements-Invoice.exe 29 PID 2636 wrote to memory of 2624 2636 rOrderRequirements-Invoice.exe 29 PID 2636 wrote to memory of 2624 2636 rOrderRequirements-Invoice.exe 29 PID 2636 wrote to memory of 2624 2636 rOrderRequirements-Invoice.exe 29 PID 2636 wrote to memory of 2668 2636 rOrderRequirements-Invoice.exe 30 PID 2636 wrote to memory of 2668 2636 rOrderRequirements-Invoice.exe 30 PID 2636 wrote to memory of 2668 2636 rOrderRequirements-Invoice.exe 30 PID 2636 wrote to memory of 2668 2636 rOrderRequirements-Invoice.exe 30 PID 2636 wrote to memory of 2540 2636 rOrderRequirements-Invoice.exe 31 PID 2636 wrote to memory of 2540 2636 rOrderRequirements-Invoice.exe 31 PID 2636 wrote to memory of 2540 2636 rOrderRequirements-Invoice.exe 31 PID 2636 wrote to memory of 2540 2636 rOrderRequirements-Invoice.exe 31 PID 2636 wrote to memory of 2684 2636 rOrderRequirements-Invoice.exe 32 PID 2636 wrote to memory of 2684 2636 rOrderRequirements-Invoice.exe 32 PID 2636 wrote to memory of 2684 2636 rOrderRequirements-Invoice.exe 32 PID 2636 wrote to memory of 2684 2636 rOrderRequirements-Invoice.exe 32 PID 2636 wrote to memory of 2528 2636 rOrderRequirements-Invoice.exe 33 PID 2636 wrote to memory of 2528 2636 rOrderRequirements-Invoice.exe 33 PID 2636 wrote to memory of 2528 2636 rOrderRequirements-Invoice.exe 33 PID 2636 wrote to memory of 2528 2636 rOrderRequirements-Invoice.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe"C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe"C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe"2⤵PID:2624
-
-
C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe"C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe"2⤵PID:2668
-
-
C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe"C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe"2⤵PID:2540
-
-
C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe"C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe"2⤵PID:2684
-
-
C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe"C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe"2⤵PID:2528
-