Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10-03-2024 01:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe
Resource
win7-20240221-en
windows7-x64
9 signatures
150 seconds
General
-
Target
86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe
-
Size
643KB
-
MD5
71b1901d05fccf33a088bbb6fa09ed3c
-
SHA1
d85d6847b167afa183430f93ce61f172f1aa0fef
-
SHA256
86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4
-
SHA512
7085f3ff512063976fef1feaa1e535286996082cdf20c8ca28b2f0d14207635d9c1c17232c78d09351f6248ebb3fc712957038f8383e61b600d8166d617b5715
-
SSDEEP
12288:UWvWgQs69RZ2RdqiHgzlnU6S8HWK/a1KPesnWwNnuFBbSEWEEEHnmfY5JdutJRMg:Nv7mRbiHSGiHb
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1720 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe 1720 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe 1720 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe 1720 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe 1720 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1720 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe 2624 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1720 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe Token: SeDebugPrivilege 2624 taskmgr.exe Token: 33 1720 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe Token: SeIncBasePriorityPrivilege 1720 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe 2624 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1720 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1720 wrote to memory of 2624 1720 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe 29 PID 1720 wrote to memory of 2624 1720 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe 29 PID 1720 wrote to memory of 2624 1720 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe 29 PID 1720 wrote to memory of 2624 1720 86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe"C:\Users\Admin\AppData\Local\Temp\86c7961267cd8368132a25dad60091bf8e8fa856d5e1c109ceb05473c005f2a4.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2624
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:2020