Analysis
-
max time kernel
300s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
04-11-2023 15:02
Behavioral task
behavioral1
Sample
Securaforge.exe
Resource
win7-20231023-en
windows7-x64
7 signatures
300 seconds
General
-
Target
Securaforge.exe
-
Size
19.7MB
-
MD5
0f30295833496cb41d844ea3c3ab405b
-
SHA1
9ed30c8654837447cb9cb7e494ab230c05a068d1
-
SHA256
4dea7012a376d5da5c950ec505e76c18646fcb9f30d83afbc6343f42a8193073
-
SHA512
f007b8e4bf8626b2f2d41f683a6793d0fff56d139ddf8c75293c41d2714c3d24b20f30491f7deee3f5afba88a01ad0b882c35df65552af014d5e85f577028c01
-
SSDEEP
393216:GmuJ9QU6rwJsUfujnbp2ZqjauUoG9itiIE7YodVExk3meWcGfdlYM/kB7:GVR6rwJsuEF2ZqjaG2D7rdWag5FlYy
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2444 Securaforge.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2724 taskmgr.exe 2444 Securaforge.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2724 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2096 wrote to memory of 2444 2096 Securaforge.exe 28 PID 2096 wrote to memory of 2444 2096 Securaforge.exe 28 PID 2096 wrote to memory of 2444 2096 Securaforge.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\Securaforge.exe"C:\Users\Admin\AppData\Local\Temp\Securaforge.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\Securaforge.exe"C:\Users\Admin\AppData\Local\Temp\Securaforge.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2444
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2724
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.5MB
MD558e01abc9c9b5c885635180ed104fe95
SHA11c2f7216b125539d63bd111a7aba615c69deb8ba
SHA256de1b95d2e951fc048c84684bc7df4346138910544ee335b61fc8e65f360c3837
SHA512cd32c77191309d99aeed47699501b357b35669123f0dd70ed97c3791a009d1855ab27162db24a4bd9e719b68ee3b0539ee6db88e71abb9a2d4d629f87bc2c081
-
Filesize
5.5MB
MD558e01abc9c9b5c885635180ed104fe95
SHA11c2f7216b125539d63bd111a7aba615c69deb8ba
SHA256de1b95d2e951fc048c84684bc7df4346138910544ee335b61fc8e65f360c3837
SHA512cd32c77191309d99aeed47699501b357b35669123f0dd70ed97c3791a009d1855ab27162db24a4bd9e719b68ee3b0539ee6db88e71abb9a2d4d629f87bc2c081