50632d0cc2b173a5f68c0a4893b37f97ce3d73be2dd6c4ea9b2f36e5a0756bdc

Analysis

max time kernel
50s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26/08/2022, 07:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3060cdf5c16afd9feee9e7d7217229cd.exe
Size 896KB
Sample220826-jpvzzaadg3
SHA256 50632d0cc2b173a5f68c0a4893b37f97ce3d73be2dd6c4ea9b2f36e5a0756bdc
MD5 3060cdf5c16afd9feee9e7d7217229cd
SHA1 d4b12dcd94012fbeadeea77cba06c3920448d12e
SHA512 c8407b8910bc18444e467f5f2af3a4b72dd72e6490230197bebaf4b9a44c4d6ceb3772a8b037c34f33ea1295e2584d254b4f470b07611a3e3a771daf0ceabe56
SSDEEP 24576:yAT/0shbH1LT/0shbTqPGxPwdhA/wK+rJE:D5LJAqyJ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1032	3060cdf5c16afd9feee9e7d7217229cd.exe
1032	3060cdf5c16afd9feee9e7d7217229cd.exe
1032	3060cdf5c16afd9feee9e7d7217229cd.exe
1032	3060cdf5c16afd9feee9e7d7217229cd.exe
1032	3060cdf5c16afd9feee9e7d7217229cd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1032	3060cdf5c16afd9feee9e7d7217229cd.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 2040	1032	3060cdf5c16afd9feee9e7d7217229cd.exe	27
PID 1032 wrote to memory of 2040	1032	3060cdf5c16afd9feee9e7d7217229cd.exe	27
PID 1032 wrote to memory of 2040	1032	3060cdf5c16afd9feee9e7d7217229cd.exe	27
PID 1032 wrote to memory of 2040	1032	3060cdf5c16afd9feee9e7d7217229cd.exe	27
PID 1032 wrote to memory of 2000	1032	3060cdf5c16afd9feee9e7d7217229cd.exe	28
PID 1032 wrote to memory of 2000	1032	3060cdf5c16afd9feee9e7d7217229cd.exe	28
PID 1032 wrote to memory of 2000	1032	3060cdf5c16afd9feee9e7d7217229cd.exe	28
PID 1032 wrote to memory of 2000	1032	3060cdf5c16afd9feee9e7d7217229cd.exe	28
PID 1032 wrote to memory of 1956	1032	3060cdf5c16afd9feee9e7d7217229cd.exe	29
PID 1032 wrote to memory of 1956	1032	3060cdf5c16afd9feee9e7d7217229cd.exe	29
PID 1032 wrote to memory of 1956	1032	3060cdf5c16afd9feee9e7d7217229cd.exe	29
PID 1032 wrote to memory of 1956	1032	3060cdf5c16afd9feee9e7d7217229cd.exe	29
PID 1032 wrote to memory of 828	1032	3060cdf5c16afd9feee9e7d7217229cd.exe	30
PID 1032 wrote to memory of 828	1032	3060cdf5c16afd9feee9e7d7217229cd.exe	30
PID 1032 wrote to memory of 828	1032	3060cdf5c16afd9feee9e7d7217229cd.exe	30
PID 1032 wrote to memory of 828	1032	3060cdf5c16afd9feee9e7d7217229cd.exe	30
PID 1032 wrote to memory of 1996	1032	3060cdf5c16afd9feee9e7d7217229cd.exe	31
PID 1032 wrote to memory of 1996	1032	3060cdf5c16afd9feee9e7d7217229cd.exe	31
PID 1032 wrote to memory of 1996	1032	3060cdf5c16afd9feee9e7d7217229cd.exe	31
PID 1032 wrote to memory of 1996	1032	3060cdf5c16afd9feee9e7d7217229cd.exe	31

C:\Users\Admin\AppData\Local\Temp\3060cdf5c16afd9feee9e7d7217229cd.exe
"C:\Users\Admin\AppData\Local\Temp\3060cdf5c16afd9feee9e7d7217229cd.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Users\Admin\AppData\Local\Temp\3060cdf5c16afd9feee9e7d7217229cd.exe
  "C:\Users\Admin\AppData\Local\Temp\3060cdf5c16afd9feee9e7d7217229cd.exe"
  2⤵
  PID:2040
- C:\Users\Admin\AppData\Local\Temp\3060cdf5c16afd9feee9e7d7217229cd.exe
  "C:\Users\Admin\AppData\Local\Temp\3060cdf5c16afd9feee9e7d7217229cd.exe"
  2⤵
  PID:2000
- C:\Users\Admin\AppData\Local\Temp\3060cdf5c16afd9feee9e7d7217229cd.exe
  "C:\Users\Admin\AppData\Local\Temp\3060cdf5c16afd9feee9e7d7217229cd.exe"
  2⤵
  PID:1956
- C:\Users\Admin\AppData\Local\Temp\3060cdf5c16afd9feee9e7d7217229cd.exe
  "C:\Users\Admin\AppData\Local\Temp\3060cdf5c16afd9feee9e7d7217229cd.exe"
  2⤵
  PID:828
- C:\Users\Admin\AppData\Local\Temp\3060cdf5c16afd9feee9e7d7217229cd.exe
  "C:\Users\Admin\AppData\Local\Temp\3060cdf5c16afd9feee9e7d7217229cd.exe"
  2⤵
  PID:1996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1032-54-0x0000000000330000-0x0000000000416000-memory.dmp

Download

memory/1032-55-0x0000000076051000-0x0000000076053000-memory.dmp

Download

memory/1032-56-0x0000000001E20000-0x0000000001E3A000-memory.dmp

Download

memory/1032-57-0x0000000001F60000-0x0000000001F6C000-memory.dmp

Download

memory/1032-58-0x0000000007E70000-0x0000000007EF8000-memory.dmp

Download

memory/1032-59-0x00000000043D0000-0x000000000440A000-memory.dmp

Download