Analysis
-
max time kernel
59s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 19:47
Static task
static1
Behavioral task
behavioral1
Sample
35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe
-
Size
589KB
-
MD5
4d5a470ac268086aba4ebd7e5f369ac7
-
SHA1
3cae8f0ead71528d665b71f0c71a594516f6185d
-
SHA256
35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af
-
SHA512
a0fc406c89e47d0291e85b1a1bdcf96f501e1065432f189201732995df2336b2a972ec367d794ca25b0d397bad7b8930457940df619b2aaf1849747b2428390e
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exepid process 1068 35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe 1068 35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe 1068 35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe 1068 35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe 1068 35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exedescription pid process Token: SeDebugPrivilege 1068 35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exedescription pid process target process PID 1068 wrote to memory of 1992 1068 35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe 35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe PID 1068 wrote to memory of 1992 1068 35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe 35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe PID 1068 wrote to memory of 1992 1068 35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe 35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe PID 1068 wrote to memory of 1992 1068 35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe 35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe PID 1068 wrote to memory of 2016 1068 35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe 35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe PID 1068 wrote to memory of 2016 1068 35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe 35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe PID 1068 wrote to memory of 2016 1068 35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe 35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe PID 1068 wrote to memory of 2016 1068 35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe 35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe PID 1068 wrote to memory of 2032 1068 35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe 35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe PID 1068 wrote to memory of 2032 1068 35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe 35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe PID 1068 wrote to memory of 2032 1068 35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe 35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe PID 1068 wrote to memory of 2032 1068 35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe 35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe PID 1068 wrote to memory of 2044 1068 35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe 35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe PID 1068 wrote to memory of 2044 1068 35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe 35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe PID 1068 wrote to memory of 2044 1068 35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe 35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe PID 1068 wrote to memory of 2044 1068 35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe 35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe PID 1068 wrote to memory of 1704 1068 35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe 35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe PID 1068 wrote to memory of 1704 1068 35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe 35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe PID 1068 wrote to memory of 1704 1068 35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe 35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe PID 1068 wrote to memory of 1704 1068 35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe 35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe"C:\Users\Admin\AppData\Local\Temp\35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe"C:\Users\Admin\AppData\Local\Temp\35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe"C:\Users\Admin\AppData\Local\Temp\35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe"C:\Users\Admin\AppData\Local\Temp\35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe"C:\Users\Admin\AppData\Local\Temp\35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe"C:\Users\Admin\AppData\Local\Temp\35f907225af129bc3fd351e6935b506ea43ec65bc897d9bc9c57c14c878e01af.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1068-54-0x00000000003A0000-0x0000000000438000-memory.dmpFilesize
608KB
-
memory/1068-55-0x0000000075C51000-0x0000000075C53000-memory.dmpFilesize
8KB
-
memory/1068-56-0x0000000000470000-0x000000000047A000-memory.dmpFilesize
40KB
-
memory/1068-57-0x0000000004E80000-0x0000000004EFC000-memory.dmpFilesize
496KB
-
memory/1068-58-0x0000000001FD0000-0x0000000001FF0000-memory.dmpFilesize
128KB