46dc49be65d7165e2a6009854a4f27f0088230199e61e0555cb1bd266535874a

Analysis

max time kernel
154s
max time network
119s
platform
windows7_x64
resource
win7v200722
submitted
11-08-2020 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

foo/928f1db0c63d122f0183686a3bdfccee.exe

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 52 IoCs

Processes:

928f1db0c63d122f0183686a3bdfccee.exewmpshare.exe

pid	process
996	928f1db0c63d122f0183686a3bdfccee.exe
996	928f1db0c63d122f0183686a3bdfccee.exe
996	928f1db0c63d122f0183686a3bdfccee.exe
996	928f1db0c63d122f0183686a3bdfccee.exe
996	928f1db0c63d122f0183686a3bdfccee.exe
996	928f1db0c63d122f0183686a3bdfccee.exe
996	928f1db0c63d122f0183686a3bdfccee.exe
996	928f1db0c63d122f0183686a3bdfccee.exe
996	928f1db0c63d122f0183686a3bdfccee.exe
996	928f1db0c63d122f0183686a3bdfccee.exe
996	928f1db0c63d122f0183686a3bdfccee.exe
996	928f1db0c63d122f0183686a3bdfccee.exe
996	928f1db0c63d122f0183686a3bdfccee.exe
996	928f1db0c63d122f0183686a3bdfccee.exe
996	928f1db0c63d122f0183686a3bdfccee.exe
996	928f1db0c63d122f0183686a3bdfccee.exe
1120	wmpshare.exe
1120	wmpshare.exe
1120	wmpshare.exe
1120	wmpshare.exe
1120	wmpshare.exe
1120	wmpshare.exe
1120	wmpshare.exe
1120	wmpshare.exe
1120	wmpshare.exe
1120	wmpshare.exe
1120	wmpshare.exe
1120	wmpshare.exe
1120	wmpshare.exe
1120	wmpshare.exe
1120	wmpshare.exe
1120	wmpshare.exe
1120	wmpshare.exe
1120	wmpshare.exe
1120	wmpshare.exe
1120	wmpshare.exe
1120	wmpshare.exe
1120	wmpshare.exe
1120	wmpshare.exe
1120	wmpshare.exe
1120	wmpshare.exe
1120	wmpshare.exe
1120	wmpshare.exe
1120	wmpshare.exe
1120	wmpshare.exe
1120	wmpshare.exe
1120	wmpshare.exe
1120	wmpshare.exe
1120	wmpshare.exe
1120	wmpshare.exe
1120	wmpshare.exe
1120	wmpshare.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

928f1db0c63d122f0183686a3bdfccee.exe

description pid process

Token: SeDebugPrivilege 996 928f1db0c63d122f0183686a3bdfccee.exe

description	pid	process
Token: SeDebugPrivilege	996	928f1db0c63d122f0183686a3bdfccee.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

928f1db0c63d122f0183686a3bdfccee.exe

description	pid	process	target process
PID 996 wrote to memory of 1484	996	928f1db0c63d122f0183686a3bdfccee.exe	wmlaunch.exe
PID 996 wrote to memory of 1484	996	928f1db0c63d122f0183686a3bdfccee.exe	wmlaunch.exe
PID 996 wrote to memory of 1484	996	928f1db0c63d122f0183686a3bdfccee.exe	wmlaunch.exe
PID 996 wrote to memory of 1484	996	928f1db0c63d122f0183686a3bdfccee.exe	wmlaunch.exe
PID 996 wrote to memory of 1484	996	928f1db0c63d122f0183686a3bdfccee.exe	wmlaunch.exe
PID 996 wrote to memory of 1484	996	928f1db0c63d122f0183686a3bdfccee.exe	wmlaunch.exe
PID 996 wrote to memory of 1484	996	928f1db0c63d122f0183686a3bdfccee.exe	wmlaunch.exe
PID 996 wrote to memory of 1484	996	928f1db0c63d122f0183686a3bdfccee.exe	wmlaunch.exe
PID 996 wrote to memory of 1484	996	928f1db0c63d122f0183686a3bdfccee.exe	wmlaunch.exe
PID 996 wrote to memory of 1120	996	928f1db0c63d122f0183686a3bdfccee.exe	wmpshare.exe
PID 996 wrote to memory of 1120	996	928f1db0c63d122f0183686a3bdfccee.exe	wmpshare.exe
PID 996 wrote to memory of 1120	996	928f1db0c63d122f0183686a3bdfccee.exe	wmpshare.exe
PID 996 wrote to memory of 1120	996	928f1db0c63d122f0183686a3bdfccee.exe	wmpshare.exe
PID 996 wrote to memory of 1120	996	928f1db0c63d122f0183686a3bdfccee.exe	wmpshare.exe
PID 996 wrote to memory of 1120	996	928f1db0c63d122f0183686a3bdfccee.exe	wmpshare.exe
PID 996 wrote to memory of 1120	996	928f1db0c63d122f0183686a3bdfccee.exe	wmpshare.exe
PID 996 wrote to memory of 1120	996	928f1db0c63d122f0183686a3bdfccee.exe	wmpshare.exe

C:\Users\Admin\AppData\Local\Temp\foo\928f1db0c63d122f0183686a3bdfccee.exe
"C:\Users\Admin\AppData\Local\Temp\foo\928f1db0c63d122f0183686a3bdfccee.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:996
- C:\Program Files (x86)\Windows Media Player\wmlaunch.exe
  -y
  2⤵
  PID:1484
- C:\Program Files (x86)\Windows Media Player\wmpshare.exe
  -lo
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1120

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\kig\qrhndid.won

MD5
5f57a89aed114838fead657f3d77b47c

SHA1
87e0b00d8a71c0810d0c7bfa5e4f23ae0680a5e8

SHA256
fc5ca8d297990d288307f60be90421a4e37e425382edee9bcc87254233d466d3

SHA512
a044eff64930eaa4ab155ee236719dee8213f05d9b372df2d7567b9ac35ceb2ba31871c42b2fdd2a7ddaf00339b62758cfd94c817ba911790c0c6dac24ff8b7a

Download Submit
C:\ProgramData\kig\zywkkc.lbg

MD5
603256b33f1157d53ff620e34840dad4

SHA1
7befd2e34522f3442a995c163fd7e2e2ecaafd4d

SHA256
634632beca1b3517c6817580dd0a6613fc6bed1ca1b102badadaabb63ae093c6

SHA512
ff5f2c5040b9d0c8adf9f3060a7b082b70fbeedd306aa5f79bbbcf459f360e0992ee2a6b12b7561b45061f5a9ebc29fb9bb998f4699dd36179ae81df2be90a1f

Download Submit
memory/996-0-0x0000000002A20000-0x0000000002AF8000-memory.dmp

Filesize
864KB

Download
memory/1120-20-0x0000000000000000-mapping.dmp

Download
memory/1120-19-0x0000000000000000-mapping.dmp

Download
memory/1120-18-0x0000000000000000-mapping.dmp

Download
memory/1484-10-0x0000000000000000-mapping.dmp

Download
memory/1484-15-0x0000000000000000-mapping.dmp

Download
memory/1484-8-0x0000000000000000-mapping.dmp

Download
memory/1484-9-0x0000000000000000-mapping.dmp

Download
memory/1484-6-0x0000000000000000-mapping.dmp

Download
memory/1484-11-0x0000000000000000-mapping.dmp

Download
memory/1484-12-0x0000000000000000-mapping.dmp

Download
memory/1484-13-0x0000000000000000-mapping.dmp

Download
memory/1484-14-0x0000000000000000-mapping.dmp

Download
memory/1484-7-0x0000000000000000-mapping.dmp

Download
memory/1484-16-0x0000000000000000-mapping.dmp

Download
memory/1484-17-0x0000000000000000-mapping.dmp

Download
memory/1484-5-0x0000000000000000-mapping.dmp

Download
memory/1484-4-0x0000000000000000-mapping.dmp

Download
memory/1484-3-0x0000000000000000-mapping.dmp

Download
memory/1484-2-0x0000000000000000-mapping.dmp

Download
memory/1484-1-0x0000000000000000-mapping.dmp

Download