Analysis
-
max time kernel
82s -
max time network
78s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
19/02/2024, 20:37
Static task
static1
Behavioral task
behavioral1
Sample
Sig.exe
Resource
win7-20231215-en
windows7-x64
5 signatures
1800 seconds
Behavioral task
behavioral2
Sample
Sig.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
4 signatures
1800 seconds
General
-
Target
Sig.exe
-
Size
1.2MB
-
MD5
4db81c82e38ed5b998b59441e3801177
-
SHA1
e3a2aca7e6686c344e2fcaa0a5e73189ad119a6a
-
SHA256
d518c979dc2c1d1501e14c64ba7321f866882537492fc9d1a50c9e0c3bbe5756
-
SHA512
c2b3d7d0b120fcbc3c93bd6589b89db2e6676c7e8fb78912c072bf1958decb025dc6b01b41011101e67aaf06c9365b312cfb52b3c3e4577c263af6e3b701d995
-
SSDEEP
24576:DoBfHpL5Z8bEjIQs/P1zTBNQ+UXZxqU1JpsY0HzitY1zBp0dxPY85219zryK4GT1:DoBfHpL5Z8bEIQEP1zTBNQnXZP1JpsYB
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2748 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2748 taskmgr.exe -
Suspicious use of FindShellTrayWindow 24 IoCs
pid Process 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Sig.exe"C:\Users\Admin\AppData\Local\Temp\Sig.exe"1⤵PID:1632
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2544
-
C:\Windows\System32\taskmgr.exe"C:\Windows\System32\taskmgr.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2748