46dc49be65d7165e2a6009854a4f27f0088230199e61e0555cb1bd266535874a | Triage

Analysis

max time kernel
49s
max time network
45s
platform
windows7_x64
resource
win7
submitted
11-08-2020 12:30

Sharing

Report Analysis Logs

General

Target

foo/0044d66e4abf7c4af6b5d207065320f7.exe

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
852	0044d66e4abf7c4af6b5d207065320f7.exe
852	0044d66e4abf7c4af6b5d207065320f7.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	852	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	852	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	852	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	852	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	852	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	852	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	852	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	852	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	852	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	852	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	852	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	852	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	852	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	852	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	852	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	852	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	852	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	852	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	852	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	852	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	852	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	852	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	852	0044d66e4abf7c4af6b5d207065320f7.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 1308	852	0044d66e4abf7c4af6b5d207065320f7.exe	20
PID 852 wrote to memory of 260	852	0044d66e4abf7c4af6b5d207065320f7.exe	1
PID 852 wrote to memory of 332	852	0044d66e4abf7c4af6b5d207065320f7.exe	2
PID 852 wrote to memory of 368	852	0044d66e4abf7c4af6b5d207065320f7.exe	3
PID 852 wrote to memory of 380	852	0044d66e4abf7c4af6b5d207065320f7.exe	4
PID 852 wrote to memory of 416	852	0044d66e4abf7c4af6b5d207065320f7.exe	5
PID 852 wrote to memory of 460	852	0044d66e4abf7c4af6b5d207065320f7.exe	6
PID 852 wrote to memory of 476	852	0044d66e4abf7c4af6b5d207065320f7.exe	7
PID 852 wrote to memory of 484	852	0044d66e4abf7c4af6b5d207065320f7.exe	8
PID 852 wrote to memory of 600	852	0044d66e4abf7c4af6b5d207065320f7.exe	9
PID 852 wrote to memory of 680	852	0044d66e4abf7c4af6b5d207065320f7.exe	10
PID 852 wrote to memory of 756	852	0044d66e4abf7c4af6b5d207065320f7.exe	11
PID 852 wrote to memory of 812	852	0044d66e4abf7c4af6b5d207065320f7.exe	12
PID 852 wrote to memory of 840	852	0044d66e4abf7c4af6b5d207065320f7.exe	13
PID 852 wrote to memory of 872	852	0044d66e4abf7c4af6b5d207065320f7.exe	14
PID 852 wrote to memory of 284	852	0044d66e4abf7c4af6b5d207065320f7.exe	16
PID 852 wrote to memory of 272	852	0044d66e4abf7c4af6b5d207065320f7.exe	17
PID 852 wrote to memory of 1148	852	0044d66e4abf7c4af6b5d207065320f7.exe	18
PID 852 wrote to memory of 1260	852	0044d66e4abf7c4af6b5d207065320f7.exe	19
PID 852 wrote to memory of 1308	852	0044d66e4abf7c4af6b5d207065320f7.exe	20

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:260

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:332

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:368
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:460
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:600
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:680
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:756
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:812
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1260
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:840
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:872
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:284
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:272
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1148
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:476
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:484

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:380

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:416

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1308
- C:\Users\Admin\AppData\Local\Temp\foo\0044d66e4abf7c4af6b5d207065320f7.exe
  "C:\Users\Admin\AppData\Local\Temp\foo\0044d66e4abf7c4af6b5d207065320f7.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/852-0-0x00000000001B0000-0x00000000001BA000-memory.dmp

Filesize
40KB

Download