abcdd0c55974259a279b283b7cf44fa8cc3c36af31171ed0a69653ef2b3cdff7

Analysis

max time kernel
50s
max time network
50s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
09/08/2022, 16:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2aa4b8d2afba3cf11d20ddddd17c7dec.exe
Size 1.2MB
Sample220809-vf811sehf4
SHA256 abcdd0c55974259a279b283b7cf44fa8cc3c36af31171ed0a69653ef2b3cdff7
MD5 2aa4b8d2afba3cf11d20ddddd17c7dec
SHA1 e39561940997be928290c22ba6c364b93e895bcf
SHA512 71a412999ba255ecedfa77d5d5a58f7140169533a24d7c725b1fe196adebbfb818cb21a126acb7e54adfc6be97bcb52342227da8edcace874a06401d9f7a5962
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1064	2aa4b8d2afba3cf11d20ddddd17c7dec.exe
1064	2aa4b8d2afba3cf11d20ddddd17c7dec.exe
1064	2aa4b8d2afba3cf11d20ddddd17c7dec.exe
1064	2aa4b8d2afba3cf11d20ddddd17c7dec.exe
1064	2aa4b8d2afba3cf11d20ddddd17c7dec.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1064	2aa4b8d2afba3cf11d20ddddd17c7dec.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 964	1064	2aa4b8d2afba3cf11d20ddddd17c7dec.exe	27
PID 1064 wrote to memory of 964	1064	2aa4b8d2afba3cf11d20ddddd17c7dec.exe	27
PID 1064 wrote to memory of 964	1064	2aa4b8d2afba3cf11d20ddddd17c7dec.exe	27
PID 1064 wrote to memory of 964	1064	2aa4b8d2afba3cf11d20ddddd17c7dec.exe	27
PID 1064 wrote to memory of 1736	1064	2aa4b8d2afba3cf11d20ddddd17c7dec.exe	28
PID 1064 wrote to memory of 1736	1064	2aa4b8d2afba3cf11d20ddddd17c7dec.exe	28
PID 1064 wrote to memory of 1736	1064	2aa4b8d2afba3cf11d20ddddd17c7dec.exe	28
PID 1064 wrote to memory of 1736	1064	2aa4b8d2afba3cf11d20ddddd17c7dec.exe	28
PID 1064 wrote to memory of 960	1064	2aa4b8d2afba3cf11d20ddddd17c7dec.exe	29
PID 1064 wrote to memory of 960	1064	2aa4b8d2afba3cf11d20ddddd17c7dec.exe	29
PID 1064 wrote to memory of 960	1064	2aa4b8d2afba3cf11d20ddddd17c7dec.exe	29
PID 1064 wrote to memory of 960	1064	2aa4b8d2afba3cf11d20ddddd17c7dec.exe	29
PID 1064 wrote to memory of 1352	1064	2aa4b8d2afba3cf11d20ddddd17c7dec.exe	30
PID 1064 wrote to memory of 1352	1064	2aa4b8d2afba3cf11d20ddddd17c7dec.exe	30
PID 1064 wrote to memory of 1352	1064	2aa4b8d2afba3cf11d20ddddd17c7dec.exe	30
PID 1064 wrote to memory of 1352	1064	2aa4b8d2afba3cf11d20ddddd17c7dec.exe	30
PID 1064 wrote to memory of 1732	1064	2aa4b8d2afba3cf11d20ddddd17c7dec.exe	31
PID 1064 wrote to memory of 1732	1064	2aa4b8d2afba3cf11d20ddddd17c7dec.exe	31
PID 1064 wrote to memory of 1732	1064	2aa4b8d2afba3cf11d20ddddd17c7dec.exe	31
PID 1064 wrote to memory of 1732	1064	2aa4b8d2afba3cf11d20ddddd17c7dec.exe	31

C:\Users\Admin\AppData\Local\Temp\2aa4b8d2afba3cf11d20ddddd17c7dec.exe
"C:\Users\Admin\AppData\Local\Temp\2aa4b8d2afba3cf11d20ddddd17c7dec.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Users\Admin\AppData\Local\Temp\2aa4b8d2afba3cf11d20ddddd17c7dec.exe
  "C:\Users\Admin\AppData\Local\Temp\2aa4b8d2afba3cf11d20ddddd17c7dec.exe"
  2⤵
  PID:964
- C:\Users\Admin\AppData\Local\Temp\2aa4b8d2afba3cf11d20ddddd17c7dec.exe
  "C:\Users\Admin\AppData\Local\Temp\2aa4b8d2afba3cf11d20ddddd17c7dec.exe"
  2⤵
  PID:1736
- C:\Users\Admin\AppData\Local\Temp\2aa4b8d2afba3cf11d20ddddd17c7dec.exe
  "C:\Users\Admin\AppData\Local\Temp\2aa4b8d2afba3cf11d20ddddd17c7dec.exe"
  2⤵
  PID:960
- C:\Users\Admin\AppData\Local\Temp\2aa4b8d2afba3cf11d20ddddd17c7dec.exe
  "C:\Users\Admin\AppData\Local\Temp\2aa4b8d2afba3cf11d20ddddd17c7dec.exe"
  2⤵
  PID:1352
- C:\Users\Admin\AppData\Local\Temp\2aa4b8d2afba3cf11d20ddddd17c7dec.exe
  "C:\Users\Admin\AppData\Local\Temp\2aa4b8d2afba3cf11d20ddddd17c7dec.exe"
  2⤵
  PID:1732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1064-54-0x00000000002F0000-0x0000000000422000-memory.dmp

Download

memory/1064-55-0x0000000076091000-0x0000000076093000-memory.dmp

Download

memory/1064-56-0x0000000000260000-0x0000000000284000-memory.dmp

Download

memory/1064-57-0x0000000000290000-0x000000000029C000-memory.dmp

Download

memory/1064-58-0x0000000007950000-0x00000000079CA000-memory.dmp

Download

memory/1064-59-0x00000000020F0000-0x000000000212A000-memory.dmp

Download