Analysis
-
max time kernel
51s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
14-05-2022 13:50
Static task
static1
Behavioral task
behavioral1
Sample
b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe
-
Size
855KB
-
MD5
0eb3390bac4066e5714f9f334ce1b573
-
SHA1
284cd714b259d872a952666b0ddc5e81eeca10f3
-
SHA256
b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e
-
SHA512
31134d969562b5a8f569d0fa8fd660c8f0e0183c9450dfed97fd6282d5b96a35abc47ada8c4bb29dd9e05eabed402838e9d12e2deff5790755861ec464a13cdb
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exepid process 1680 b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe 1680 b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe 1680 b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe 1680 b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe 1680 b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exedescription pid process Token: SeDebugPrivilege 1680 b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exedescription pid process target process PID 1680 wrote to memory of 980 1680 b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe PID 1680 wrote to memory of 980 1680 b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe PID 1680 wrote to memory of 980 1680 b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe PID 1680 wrote to memory of 980 1680 b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe PID 1680 wrote to memory of 2000 1680 b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe PID 1680 wrote to memory of 2000 1680 b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe PID 1680 wrote to memory of 2000 1680 b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe PID 1680 wrote to memory of 2000 1680 b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe PID 1680 wrote to memory of 2024 1680 b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe PID 1680 wrote to memory of 2024 1680 b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe PID 1680 wrote to memory of 2024 1680 b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe PID 1680 wrote to memory of 2024 1680 b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe PID 1680 wrote to memory of 2044 1680 b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe PID 1680 wrote to memory of 2044 1680 b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe PID 1680 wrote to memory of 2044 1680 b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe PID 1680 wrote to memory of 2044 1680 b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe PID 1680 wrote to memory of 1112 1680 b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe PID 1680 wrote to memory of 1112 1680 b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe PID 1680 wrote to memory of 1112 1680 b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe PID 1680 wrote to memory of 1112 1680 b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe"C:\Users\Admin\AppData\Local\Temp\b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe"C:\Users\Admin\AppData\Local\Temp\b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe"2⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe"C:\Users\Admin\AppData\Local\Temp\b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe"2⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe"C:\Users\Admin\AppData\Local\Temp\b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe"2⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe"C:\Users\Admin\AppData\Local\Temp\b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe"2⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe"C:\Users\Admin\AppData\Local\Temp\b42dbca35ee7fb914d2566cd137fa7f8c69036e6824ac3dc2bf7d50198742c5e.exe"2⤵PID:1112
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1680-54-0x0000000000330000-0x000000000040A000-memory.dmpFilesize
872KB
-
memory/1680-55-0x00000000752B1000-0x00000000752B3000-memory.dmpFilesize
8KB
-
memory/1680-56-0x0000000000430000-0x000000000043E000-memory.dmpFilesize
56KB
-
memory/1680-57-0x0000000005AC0000-0x0000000005B2A000-memory.dmpFilesize
424KB
-
memory/1680-58-0x0000000001FE0000-0x0000000001FE6000-memory.dmpFilesize
24KB
-
memory/1680-59-0x0000000004780000-0x00000000047AA000-memory.dmpFilesize
168KB