Analysis
-
max time kernel
76s -
max time network
12s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
27-07-2021 07:30
Static task
static1
Behavioral task
behavioral1
Sample
de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe
-
Size
3.7MB
-
MD5
00fd3c68b44a6e82a6c516e6326dd89f
-
SHA1
a0d06dfc640fcaf4533962a11b4907c2dbbdfc8d
-
SHA256
de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30
-
SHA512
92a6b9b7eda12966869d1192c5bc9abc793a1428ef8c0463c18677b03fc6c6ee9482a3559d8c20dc7284167cbecfdc77c58367cab5d9a3b0e83ae91eab3a7bfc
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exepid process 772 de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe 772 de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe 772 de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe 772 de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe 772 de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exedescription pid process Token: SeDebugPrivilege 772 de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exedescription pid process target process PID 772 wrote to memory of 300 772 de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe PID 772 wrote to memory of 300 772 de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe PID 772 wrote to memory of 300 772 de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe PID 772 wrote to memory of 300 772 de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe PID 772 wrote to memory of 1716 772 de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe PID 772 wrote to memory of 1716 772 de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe PID 772 wrote to memory of 1716 772 de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe PID 772 wrote to memory of 1716 772 de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe PID 772 wrote to memory of 832 772 de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe PID 772 wrote to memory of 832 772 de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe PID 772 wrote to memory of 832 772 de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe PID 772 wrote to memory of 832 772 de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe PID 772 wrote to memory of 1012 772 de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe PID 772 wrote to memory of 1012 772 de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe PID 772 wrote to memory of 1012 772 de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe PID 772 wrote to memory of 1012 772 de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe PID 772 wrote to memory of 396 772 de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe PID 772 wrote to memory of 396 772 de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe PID 772 wrote to memory of 396 772 de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe PID 772 wrote to memory of 396 772 de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe"C:\Users\Admin\AppData\Local\Temp\de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe"C:\Users\Admin\AppData\Local\Temp\de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe"C:\Users\Admin\AppData\Local\Temp\de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe"C:\Users\Admin\AppData\Local\Temp\de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe"C:\Users\Admin\AppData\Local\Temp\de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe"C:\Users\Admin\AppData\Local\Temp\de356fa5f4820cbc26b24852c1052c73dc4029e0a08f9f2a857f5a12434dca30.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/772-60-0x0000000000160000-0x0000000000161000-memory.dmpFilesize
4KB
-
memory/772-62-0x0000000004F00000-0x0000000004F01000-memory.dmpFilesize
4KB
-
memory/772-63-0x00000000020E0000-0x00000000020E4000-memory.dmpFilesize
16KB
-
memory/772-64-0x00000000045F0000-0x0000000004638000-memory.dmpFilesize
288KB