c2e8eab84c23134e367654536c0e40144e4c1c7ad5aaa09443dca439203bfca6

Analysis

max time kernel
121s
max time network
139s
platform
windows7_x64
resource
win7v20210410
submitted
20-04-2021 10:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
Size

407KB
MD5

4698544b9533d620f28d25ca14a8f92b
SHA1

bbe0896a3360084ea2cbd06f5a5780f7df3ad6f2
SHA256

047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8
SHA512

af9d5a0db07c603534b28d18fe805a6cfa66969c0db74ceb4038ef0101acf2a0d7e7e3a781b1795084a89561d16021a645f6147850caefd31b04bb808e3f59ad

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe

pid process

1748 047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe

Suspicious behavior: MapViewOfSection 20 IoCs

Processes:

047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe

pid	process
1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe

description pid process

Token: SeDebugPrivilege 1748 047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe

description	pid	process
Token: SeDebugPrivilege	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe

description	pid	process	target process
PID 1748 wrote to memory of 372	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	wininit.exe
PID 1748 wrote to memory of 372	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	wininit.exe
PID 1748 wrote to memory of 372	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	wininit.exe
PID 1748 wrote to memory of 372	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	wininit.exe
PID 1748 wrote to memory of 372	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	wininit.exe
PID 1748 wrote to memory of 372	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	wininit.exe
PID 1748 wrote to memory of 372	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	wininit.exe
PID 1748 wrote to memory of 380	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	csrss.exe
PID 1748 wrote to memory of 380	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	csrss.exe
PID 1748 wrote to memory of 380	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	csrss.exe
PID 1748 wrote to memory of 380	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	csrss.exe
PID 1748 wrote to memory of 380	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	csrss.exe
PID 1748 wrote to memory of 380	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	csrss.exe
PID 1748 wrote to memory of 380	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	csrss.exe
PID 1748 wrote to memory of 420	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	winlogon.exe
PID 1748 wrote to memory of 420	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	winlogon.exe
PID 1748 wrote to memory of 420	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	winlogon.exe
PID 1748 wrote to memory of 420	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	winlogon.exe
PID 1748 wrote to memory of 420	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	winlogon.exe
PID 1748 wrote to memory of 420	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	winlogon.exe
PID 1748 wrote to memory of 420	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	winlogon.exe
PID 1748 wrote to memory of 468	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	services.exe
PID 1748 wrote to memory of 468	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	services.exe
PID 1748 wrote to memory of 468	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	services.exe
PID 1748 wrote to memory of 468	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	services.exe
PID 1748 wrote to memory of 468	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	services.exe
PID 1748 wrote to memory of 468	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	services.exe
PID 1748 wrote to memory of 468	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	services.exe
PID 1748 wrote to memory of 476	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	lsass.exe
PID 1748 wrote to memory of 476	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	lsass.exe
PID 1748 wrote to memory of 476	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	lsass.exe
PID 1748 wrote to memory of 476	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	lsass.exe
PID 1748 wrote to memory of 476	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	lsass.exe
PID 1748 wrote to memory of 476	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	lsass.exe
PID 1748 wrote to memory of 476	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	lsass.exe
PID 1748 wrote to memory of 484	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	lsm.exe
PID 1748 wrote to memory of 484	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	lsm.exe
PID 1748 wrote to memory of 484	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	lsm.exe
PID 1748 wrote to memory of 484	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	lsm.exe
PID 1748 wrote to memory of 484	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	lsm.exe
PID 1748 wrote to memory of 484	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	lsm.exe
PID 1748 wrote to memory of 484	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	lsm.exe
PID 1748 wrote to memory of 580	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1748 wrote to memory of 580	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1748 wrote to memory of 580	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1748 wrote to memory of 580	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1748 wrote to memory of 580	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1748 wrote to memory of 580	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1748 wrote to memory of 580	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1748 wrote to memory of 660	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1748 wrote to memory of 660	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1748 wrote to memory of 660	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1748 wrote to memory of 660	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1748 wrote to memory of 660	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1748 wrote to memory of 660	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1748 wrote to memory of 660	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1748 wrote to memory of 744	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1748 wrote to memory of 744	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1748 wrote to memory of 744	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1748 wrote to memory of 744	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1748 wrote to memory of 744	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1748 wrote to memory of 744	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1748 wrote to memory of 744	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe
PID 1748 wrote to memory of 796	1748	047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe	svchost.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:476

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
2⤵
PID:580

C:\Windows\system32\taskhost.exe
"taskhost.exe"
2⤵
PID:1116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
2⤵
PID:1052

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
2⤵
PID:328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
2⤵
PID:240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
2⤵
PID:876

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
3⤵
PID:1828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
2⤵
PID:824

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
2⤵
PID:796

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
2⤵
PID:744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
2⤵
PID:660

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:380

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-2112777347119662564316717971201258821549-214332214317250074-13439356551356107061"
2⤵
PID:1976

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:372

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
2⤵
PID:484

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1196

C:\Users\Admin\AppData\Local\Temp\047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe
"C:\Users\Admin\AppData\Local\Temp\047c2a3d2157d2ee24ebe9b9b74148c1e4e29a3eacf1d1145faf785361afb4d8.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1748

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads