Analysis
-
max time kernel
180s -
max time network
187s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
24-05-2022 23:43
Behavioral task
behavioral1
Sample
645a6c93449bcfb3dbaa3c016e40daf590fcc125cb3243e0fe0f34b8f8e30d52.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
645a6c93449bcfb3dbaa3c016e40daf590fcc125cb3243e0fe0f34b8f8e30d52.exe
-
Size
658KB
-
MD5
98343399d5aac84bacbeddc5a3385836
-
SHA1
e1c7bb2b21d7f46de57c26b407235972b1a6e28a
-
SHA256
645a6c93449bcfb3dbaa3c016e40daf590fcc125cb3243e0fe0f34b8f8e30d52
-
SHA512
39a0daf741484e8bd692ab2abfec76f534ebb84ee72c41337d4499fba04c590da9fbd627a003038147a3dcf94b6198ab9f2cda52d480e7afd288a0f4fcc4471c
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
645a6c93449bcfb3dbaa3c016e40daf590fcc125cb3243e0fe0f34b8f8e30d52.exedescription pid process target process PID 1716 set thread context of 1160 1716 645a6c93449bcfb3dbaa3c016e40daf590fcc125cb3243e0fe0f34b8f8e30d52.exe iexplore.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
645a6c93449bcfb3dbaa3c016e40daf590fcc125cb3243e0fe0f34b8f8e30d52.exeiexplore.exedescription pid process Token: SeIncreaseQuotaPrivilege 1716 645a6c93449bcfb3dbaa3c016e40daf590fcc125cb3243e0fe0f34b8f8e30d52.exe Token: SeSecurityPrivilege 1716 645a6c93449bcfb3dbaa3c016e40daf590fcc125cb3243e0fe0f34b8f8e30d52.exe Token: SeTakeOwnershipPrivilege 1716 645a6c93449bcfb3dbaa3c016e40daf590fcc125cb3243e0fe0f34b8f8e30d52.exe Token: SeLoadDriverPrivilege 1716 645a6c93449bcfb3dbaa3c016e40daf590fcc125cb3243e0fe0f34b8f8e30d52.exe Token: SeSystemProfilePrivilege 1716 645a6c93449bcfb3dbaa3c016e40daf590fcc125cb3243e0fe0f34b8f8e30d52.exe Token: SeSystemtimePrivilege 1716 645a6c93449bcfb3dbaa3c016e40daf590fcc125cb3243e0fe0f34b8f8e30d52.exe Token: SeProfSingleProcessPrivilege 1716 645a6c93449bcfb3dbaa3c016e40daf590fcc125cb3243e0fe0f34b8f8e30d52.exe Token: SeIncBasePriorityPrivilege 1716 645a6c93449bcfb3dbaa3c016e40daf590fcc125cb3243e0fe0f34b8f8e30d52.exe Token: SeCreatePagefilePrivilege 1716 645a6c93449bcfb3dbaa3c016e40daf590fcc125cb3243e0fe0f34b8f8e30d52.exe Token: SeBackupPrivilege 1716 645a6c93449bcfb3dbaa3c016e40daf590fcc125cb3243e0fe0f34b8f8e30d52.exe Token: SeRestorePrivilege 1716 645a6c93449bcfb3dbaa3c016e40daf590fcc125cb3243e0fe0f34b8f8e30d52.exe Token: SeShutdownPrivilege 1716 645a6c93449bcfb3dbaa3c016e40daf590fcc125cb3243e0fe0f34b8f8e30d52.exe Token: SeDebugPrivilege 1716 645a6c93449bcfb3dbaa3c016e40daf590fcc125cb3243e0fe0f34b8f8e30d52.exe Token: SeSystemEnvironmentPrivilege 1716 645a6c93449bcfb3dbaa3c016e40daf590fcc125cb3243e0fe0f34b8f8e30d52.exe Token: SeChangeNotifyPrivilege 1716 645a6c93449bcfb3dbaa3c016e40daf590fcc125cb3243e0fe0f34b8f8e30d52.exe Token: SeRemoteShutdownPrivilege 1716 645a6c93449bcfb3dbaa3c016e40daf590fcc125cb3243e0fe0f34b8f8e30d52.exe Token: SeUndockPrivilege 1716 645a6c93449bcfb3dbaa3c016e40daf590fcc125cb3243e0fe0f34b8f8e30d52.exe Token: SeManageVolumePrivilege 1716 645a6c93449bcfb3dbaa3c016e40daf590fcc125cb3243e0fe0f34b8f8e30d52.exe Token: SeImpersonatePrivilege 1716 645a6c93449bcfb3dbaa3c016e40daf590fcc125cb3243e0fe0f34b8f8e30d52.exe Token: SeCreateGlobalPrivilege 1716 645a6c93449bcfb3dbaa3c016e40daf590fcc125cb3243e0fe0f34b8f8e30d52.exe Token: 33 1716 645a6c93449bcfb3dbaa3c016e40daf590fcc125cb3243e0fe0f34b8f8e30d52.exe Token: 34 1716 645a6c93449bcfb3dbaa3c016e40daf590fcc125cb3243e0fe0f34b8f8e30d52.exe Token: 35 1716 645a6c93449bcfb3dbaa3c016e40daf590fcc125cb3243e0fe0f34b8f8e30d52.exe Token: SeIncreaseQuotaPrivilege 1160 iexplore.exe Token: SeSecurityPrivilege 1160 iexplore.exe Token: SeTakeOwnershipPrivilege 1160 iexplore.exe Token: SeLoadDriverPrivilege 1160 iexplore.exe Token: SeSystemProfilePrivilege 1160 iexplore.exe Token: SeSystemtimePrivilege 1160 iexplore.exe Token: SeProfSingleProcessPrivilege 1160 iexplore.exe Token: SeIncBasePriorityPrivilege 1160 iexplore.exe Token: SeCreatePagefilePrivilege 1160 iexplore.exe Token: SeBackupPrivilege 1160 iexplore.exe Token: SeRestorePrivilege 1160 iexplore.exe Token: SeShutdownPrivilege 1160 iexplore.exe Token: SeDebugPrivilege 1160 iexplore.exe Token: SeSystemEnvironmentPrivilege 1160 iexplore.exe Token: SeChangeNotifyPrivilege 1160 iexplore.exe Token: SeRemoteShutdownPrivilege 1160 iexplore.exe Token: SeUndockPrivilege 1160 iexplore.exe Token: SeManageVolumePrivilege 1160 iexplore.exe Token: SeImpersonatePrivilege 1160 iexplore.exe Token: SeCreateGlobalPrivilege 1160 iexplore.exe Token: 33 1160 iexplore.exe Token: 34 1160 iexplore.exe Token: 35 1160 iexplore.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
iexplore.exepid process 1160 iexplore.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
645a6c93449bcfb3dbaa3c016e40daf590fcc125cb3243e0fe0f34b8f8e30d52.exedescription pid process target process PID 1716 wrote to memory of 1160 1716 645a6c93449bcfb3dbaa3c016e40daf590fcc125cb3243e0fe0f34b8f8e30d52.exe iexplore.exe PID 1716 wrote to memory of 1160 1716 645a6c93449bcfb3dbaa3c016e40daf590fcc125cb3243e0fe0f34b8f8e30d52.exe iexplore.exe PID 1716 wrote to memory of 1160 1716 645a6c93449bcfb3dbaa3c016e40daf590fcc125cb3243e0fe0f34b8f8e30d52.exe iexplore.exe PID 1716 wrote to memory of 1160 1716 645a6c93449bcfb3dbaa3c016e40daf590fcc125cb3243e0fe0f34b8f8e30d52.exe iexplore.exe PID 1716 wrote to memory of 1160 1716 645a6c93449bcfb3dbaa3c016e40daf590fcc125cb3243e0fe0f34b8f8e30d52.exe iexplore.exe PID 1716 wrote to memory of 1160 1716 645a6c93449bcfb3dbaa3c016e40daf590fcc125cb3243e0fe0f34b8f8e30d52.exe iexplore.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\645a6c93449bcfb3dbaa3c016e40daf590fcc125cb3243e0fe0f34b8f8e30d52.exe"C:\Users\Admin\AppData\Local\Temp\645a6c93449bcfb3dbaa3c016e40daf590fcc125cb3243e0fe0f34b8f8e30d52.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1716-54-0x00000000754A1000-0x00000000754A3000-memory.dmpFilesize
8KB