Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
16-07-2024 19:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
AWD_Doc.exe
Resource
win7-20240704-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
AWD_Doc.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
AWD_Doc.exe
-
Size
139KB
-
MD5
ec80bb801f8113daf41d1b8e15fa8e2e
-
SHA1
292b792b1bd60b0a17aff237a8d8fc2f0aa1f09c
-
SHA256
83544a1f58caad71a03ed0f6e99f787e23ff20229f0a4c03622797fe62843a1b
-
SHA512
797f6047ac736042bf081e55cf04f86a97abe444609b91f4c7fe14aa477b0f8a86c6c8f17a0f3de340bd5193b5a6fe94f71ce26f3e9d1d7a0b53c0d5410c06ff
-
SSDEEP
1536:JXEYsHcKIiGuxVlPTGEDnFCma93EtMkj+WL17h9B4OJY51NjDRWtPOW5vAQktlGZ:CFlkmnjil3Cf54Qm8r0DoOuae4/I
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 2668 AWD_Doc.exe 2668 AWD_Doc.exe 2668 AWD_Doc.exe 2668 AWD_Doc.exe 2668 AWD_Doc.exe 2668 AWD_Doc.exe 2668 AWD_Doc.exe 2668 AWD_Doc.exe 2668 AWD_Doc.exe 2668 AWD_Doc.exe 2668 AWD_Doc.exe 2668 AWD_Doc.exe 2668 AWD_Doc.exe 2668 AWD_Doc.exe 2668 AWD_Doc.exe 2668 AWD_Doc.exe 2668 AWD_Doc.exe 2668 AWD_Doc.exe 2668 AWD_Doc.exe 2668 AWD_Doc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2668 AWD_Doc.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 2668 wrote to memory of 2688 2668 AWD_Doc.exe 31 PID 2668 wrote to memory of 2688 2668 AWD_Doc.exe 31 PID 2668 wrote to memory of 2688 2668 AWD_Doc.exe 31 PID 2668 wrote to memory of 2688 2668 AWD_Doc.exe 31 PID 2668 wrote to memory of 3036 2668 AWD_Doc.exe 32 PID 2668 wrote to memory of 3036 2668 AWD_Doc.exe 32 PID 2668 wrote to memory of 3036 2668 AWD_Doc.exe 32 PID 2668 wrote to memory of 3036 2668 AWD_Doc.exe 32 PID 2668 wrote to memory of 2680 2668 AWD_Doc.exe 33 PID 2668 wrote to memory of 2680 2668 AWD_Doc.exe 33 PID 2668 wrote to memory of 2680 2668 AWD_Doc.exe 33 PID 2668 wrote to memory of 2680 2668 AWD_Doc.exe 33 PID 2668 wrote to memory of 2832 2668 AWD_Doc.exe 34 PID 2668 wrote to memory of 2832 2668 AWD_Doc.exe 34 PID 2668 wrote to memory of 2832 2668 AWD_Doc.exe 34 PID 2668 wrote to memory of 2832 2668 AWD_Doc.exe 34 PID 2668 wrote to memory of 2600 2668 AWD_Doc.exe 35 PID 2668 wrote to memory of 2600 2668 AWD_Doc.exe 35 PID 2668 wrote to memory of 2600 2668 AWD_Doc.exe 35 PID 2668 wrote to memory of 2600 2668 AWD_Doc.exe 35 PID 2668 wrote to memory of 2804 2668 AWD_Doc.exe 36 PID 2668 wrote to memory of 2804 2668 AWD_Doc.exe 36 PID 2668 wrote to memory of 2804 2668 AWD_Doc.exe 36 PID 2668 wrote to memory of 2804 2668 AWD_Doc.exe 36 PID 2668 wrote to memory of 2808 2668 AWD_Doc.exe 37 PID 2668 wrote to memory of 2808 2668 AWD_Doc.exe 37 PID 2668 wrote to memory of 2808 2668 AWD_Doc.exe 37 PID 2668 wrote to memory of 2808 2668 AWD_Doc.exe 37 PID 2668 wrote to memory of 2748 2668 AWD_Doc.exe 38 PID 2668 wrote to memory of 2748 2668 AWD_Doc.exe 38 PID 2668 wrote to memory of 2748 2668 AWD_Doc.exe 38 PID 2668 wrote to memory of 2748 2668 AWD_Doc.exe 38 PID 2668 wrote to memory of 2860 2668 AWD_Doc.exe 39 PID 2668 wrote to memory of 2860 2668 AWD_Doc.exe 39 PID 2668 wrote to memory of 2860 2668 AWD_Doc.exe 39 PID 2668 wrote to memory of 2860 2668 AWD_Doc.exe 39 PID 2668 wrote to memory of 2740 2668 AWD_Doc.exe 40 PID 2668 wrote to memory of 2740 2668 AWD_Doc.exe 40 PID 2668 wrote to memory of 2740 2668 AWD_Doc.exe 40 PID 2668 wrote to memory of 2740 2668 AWD_Doc.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\AWD_Doc.exe"C:\Users\Admin\AppData\Local\Temp\AWD_Doc.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵PID:2688
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵PID:3036
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵PID:2680
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵PID:2832
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵PID:2600
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵PID:2804
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵PID:2808
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵PID:2748
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵PID:2860
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵PID:2740
-