Analysis
-
max time kernel
46s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
31/05/2024, 11:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cd57e4c171d6e8f5ea8b8f824a6a7316.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
cd57e4c171d6e8f5ea8b8f824a6a7316.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
cd57e4c171d6e8f5ea8b8f824a6a7316.exe
-
Size
85KB
-
MD5
f8f4522d11178a26e97e2046f249dfa7
-
SHA1
8b591d9a37716e235260fb6b3f601e4ccbebf15d
-
SHA256
3c372a8919c28dc76414b2f30da423c3e1018b1a8444527949ce20cc3fc93ed0
-
SHA512
52ea881cad501cf1d5e8ac47355e862ac1bd39cb6e1ff3d362d392b6f2d676e74878832505d17a552aaa3bc8f3977da11fa3f9903722eedd23716fb46ddb7492
-
SSDEEP
1536:6vFJ5SF9I3BbbHVlnOXrPBdfeISRAOl801AbcsqD95wSxdRfP:eFJ5S7Mbb1lnOXrPXe7Yhq5Z3
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2596 taskmgr.exe -
Suspicious use of FindShellTrayWindow 30 IoCs
pid Process 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe -
Suspicious use of SendNotifyMessage 30 IoCs
pid Process 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2172 wrote to memory of 2780 2172 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 28 PID 2172 wrote to memory of 2780 2172 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 28 PID 2172 wrote to memory of 2780 2172 cd57e4c171d6e8f5ea8b8f824a6a7316.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd57e4c171d6e8f5ea8b8f824a6a7316.exe"C:\Users\Admin\AppData\Local\Temp\cd57e4c171d6e8f5ea8b8f824a6a7316.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2172 -s 6162⤵PID:2780
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2596