ede54ddd1ad0cc12aeb64653aee9b3d056263312bf2221ee7f640fd3fcbf11cb

Analysis

max time kernel
51s
max time network
46s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
09/08/2022, 03:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.W32.AIDetectNet.01.27415.exe
Size 1.0MB
Sample220809-d37b9scchl
SHA256 ede54ddd1ad0cc12aeb64653aee9b3d056263312bf2221ee7f640fd3fcbf11cb
MD5 3116f5c3b1afe1ec9eaf8671b2dee58b
SHA1 aca6215f152a83f815bcd848fd6ad6025805b429
SHA512 0034a035e2433af894b70fe12a6da9d81ee1f6dc5bbab565541257c6f935fb7434a42380b76df3b3eb3b01552ad94c9711371e5d088b79f5c6ab3cfc00284f3c
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2040	SecuriteInfo.com.W32.AIDetectNet.01.27415.exe
2040	SecuriteInfo.com.W32.AIDetectNet.01.27415.exe
2040	SecuriteInfo.com.W32.AIDetectNet.01.27415.exe
2040	SecuriteInfo.com.W32.AIDetectNet.01.27415.exe
2040	SecuriteInfo.com.W32.AIDetectNet.01.27415.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2040	SecuriteInfo.com.W32.AIDetectNet.01.27415.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1576	2040	SecuriteInfo.com.W32.AIDetectNet.01.27415.exe	28
PID 2040 wrote to memory of 1576	2040	SecuriteInfo.com.W32.AIDetectNet.01.27415.exe	28
PID 2040 wrote to memory of 1576	2040	SecuriteInfo.com.W32.AIDetectNet.01.27415.exe	28
PID 2040 wrote to memory of 1576	2040	SecuriteInfo.com.W32.AIDetectNet.01.27415.exe	28
PID 2040 wrote to memory of 1636	2040	SecuriteInfo.com.W32.AIDetectNet.01.27415.exe	29
PID 2040 wrote to memory of 1636	2040	SecuriteInfo.com.W32.AIDetectNet.01.27415.exe	29
PID 2040 wrote to memory of 1636	2040	SecuriteInfo.com.W32.AIDetectNet.01.27415.exe	29
PID 2040 wrote to memory of 1636	2040	SecuriteInfo.com.W32.AIDetectNet.01.27415.exe	29
PID 2040 wrote to memory of 1440	2040	SecuriteInfo.com.W32.AIDetectNet.01.27415.exe	30
PID 2040 wrote to memory of 1440	2040	SecuriteInfo.com.W32.AIDetectNet.01.27415.exe	30
PID 2040 wrote to memory of 1440	2040	SecuriteInfo.com.W32.AIDetectNet.01.27415.exe	30
PID 2040 wrote to memory of 1440	2040	SecuriteInfo.com.W32.AIDetectNet.01.27415.exe	30
PID 2040 wrote to memory of 1628	2040	SecuriteInfo.com.W32.AIDetectNet.01.27415.exe	31
PID 2040 wrote to memory of 1628	2040	SecuriteInfo.com.W32.AIDetectNet.01.27415.exe	31
PID 2040 wrote to memory of 1628	2040	SecuriteInfo.com.W32.AIDetectNet.01.27415.exe	31
PID 2040 wrote to memory of 1628	2040	SecuriteInfo.com.W32.AIDetectNet.01.27415.exe	31
PID 2040 wrote to memory of 624	2040	SecuriteInfo.com.W32.AIDetectNet.01.27415.exe	32
PID 2040 wrote to memory of 624	2040	SecuriteInfo.com.W32.AIDetectNet.01.27415.exe	32
PID 2040 wrote to memory of 624	2040	SecuriteInfo.com.W32.AIDetectNet.01.27415.exe	32
PID 2040 wrote to memory of 624	2040	SecuriteInfo.com.W32.AIDetectNet.01.27415.exe	32

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.27415.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.27415.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.27415.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.27415.exe"
  2⤵
  PID:1576
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.27415.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.27415.exe"
  2⤵
  PID:1636
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.27415.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.27415.exe"
  2⤵
  PID:1440
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.27415.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.27415.exe"
  2⤵
  PID:1628
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.27415.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.27415.exe"
  2⤵
  PID:624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2040-54-0x0000000000360000-0x0000000000468000-memory.dmp

Download

memory/2040-55-0x0000000075A81000-0x0000000075A83000-memory.dmp

Download

memory/2040-56-0x00000000005F0000-0x0000000000614000-memory.dmp

Download

memory/2040-57-0x0000000000610000-0x000000000061C000-memory.dmp

Download

memory/2040-58-0x0000000005370000-0x00000000053EA000-memory.dmp

Download

memory/2040-59-0x0000000001F70000-0x0000000001FAA000-memory.dmp

Download