6fe17a3081db76f75994ffe5bdb2be7a73404537a1539845cefe6ce9003f1c40

Analysis

max time kernel
57s
max time network
39s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
15/09/2022, 07:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b7756b8a5d1d1df5ce638ec627654f5c.exe
Size

1.0MB
MD5

b7756b8a5d1d1df5ce638ec627654f5c
SHA1

39623b78af9bcbefb09e8468111f3bb07464d886
SHA256

6fe17a3081db76f75994ffe5bdb2be7a73404537a1539845cefe6ce9003f1c40
SHA512

af22d7bce3ebdf1e3d3eeadc444429636a418e251d874b2f8337f8f405af38591c190b434fb96cf8791d3bc9e768319995bf5f5e146c860550a9736bbdd03989
SSDEEP

24576:/arBlubg5kb0LwZ1Hhj07iWp6qxUn0E1:it4s5kEGBAmW8qxw

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1488	b7756b8a5d1d1df5ce638ec627654f5c.exe
1488	b7756b8a5d1d1df5ce638ec627654f5c.exe
1488	b7756b8a5d1d1df5ce638ec627654f5c.exe
1488	b7756b8a5d1d1df5ce638ec627654f5c.exe
1488	b7756b8a5d1d1df5ce638ec627654f5c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1488	b7756b8a5d1d1df5ce638ec627654f5c.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1488	b7756b8a5d1d1df5ce638ec627654f5c.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1488	b7756b8a5d1d1df5ce638ec627654f5c.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 1624	1488	b7756b8a5d1d1df5ce638ec627654f5c.exe	27
PID 1488 wrote to memory of 1624	1488	b7756b8a5d1d1df5ce638ec627654f5c.exe	27
PID 1488 wrote to memory of 1624	1488	b7756b8a5d1d1df5ce638ec627654f5c.exe	27
PID 1488 wrote to memory of 1624	1488	b7756b8a5d1d1df5ce638ec627654f5c.exe	27
PID 1488 wrote to memory of 1196	1488	b7756b8a5d1d1df5ce638ec627654f5c.exe	28
PID 1488 wrote to memory of 1196	1488	b7756b8a5d1d1df5ce638ec627654f5c.exe	28
PID 1488 wrote to memory of 1196	1488	b7756b8a5d1d1df5ce638ec627654f5c.exe	28
PID 1488 wrote to memory of 1196	1488	b7756b8a5d1d1df5ce638ec627654f5c.exe	28
PID 1488 wrote to memory of 1712	1488	b7756b8a5d1d1df5ce638ec627654f5c.exe	29
PID 1488 wrote to memory of 1712	1488	b7756b8a5d1d1df5ce638ec627654f5c.exe	29
PID 1488 wrote to memory of 1712	1488	b7756b8a5d1d1df5ce638ec627654f5c.exe	29
PID 1488 wrote to memory of 1712	1488	b7756b8a5d1d1df5ce638ec627654f5c.exe	29
PID 1488 wrote to memory of 1364	1488	b7756b8a5d1d1df5ce638ec627654f5c.exe	30
PID 1488 wrote to memory of 1364	1488	b7756b8a5d1d1df5ce638ec627654f5c.exe	30
PID 1488 wrote to memory of 1364	1488	b7756b8a5d1d1df5ce638ec627654f5c.exe	30
PID 1488 wrote to memory of 1364	1488	b7756b8a5d1d1df5ce638ec627654f5c.exe	30
PID 1488 wrote to memory of 1508	1488	b7756b8a5d1d1df5ce638ec627654f5c.exe	31
PID 1488 wrote to memory of 1508	1488	b7756b8a5d1d1df5ce638ec627654f5c.exe	31
PID 1488 wrote to memory of 1508	1488	b7756b8a5d1d1df5ce638ec627654f5c.exe	31
PID 1488 wrote to memory of 1508	1488	b7756b8a5d1d1df5ce638ec627654f5c.exe	31

C:\Users\Admin\AppData\Local\Temp\b7756b8a5d1d1df5ce638ec627654f5c.exe
"C:\Users\Admin\AppData\Local\Temp\b7756b8a5d1d1df5ce638ec627654f5c.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Users\Admin\AppData\Local\Temp\b7756b8a5d1d1df5ce638ec627654f5c.exe
  "C:\Users\Admin\AppData\Local\Temp\b7756b8a5d1d1df5ce638ec627654f5c.exe"
  2⤵
  PID:1624
- C:\Users\Admin\AppData\Local\Temp\b7756b8a5d1d1df5ce638ec627654f5c.exe
  "C:\Users\Admin\AppData\Local\Temp\b7756b8a5d1d1df5ce638ec627654f5c.exe"
  2⤵
  PID:1196
- C:\Users\Admin\AppData\Local\Temp\b7756b8a5d1d1df5ce638ec627654f5c.exe
  "C:\Users\Admin\AppData\Local\Temp\b7756b8a5d1d1df5ce638ec627654f5c.exe"
  2⤵
  PID:1712
- C:\Users\Admin\AppData\Local\Temp\b7756b8a5d1d1df5ce638ec627654f5c.exe
  "C:\Users\Admin\AppData\Local\Temp\b7756b8a5d1d1df5ce638ec627654f5c.exe"
  2⤵
  PID:1364
- C:\Users\Admin\AppData\Local\Temp\b7756b8a5d1d1df5ce638ec627654f5c.exe
  "C:\Users\Admin\AppData\Local\Temp\b7756b8a5d1d1df5ce638ec627654f5c.exe"
  2⤵
  PID:1508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1488-54-0x0000000000340000-0x0000000000448000-memory.dmp

Filesize
1.0MB

Download
memory/1488-55-0x0000000075AD1000-0x0000000075AD3000-memory.dmp

Filesize
8KB

Download
memory/1488-56-0x0000000000650000-0x0000000000666000-memory.dmp

Filesize
88KB

Download
memory/1488-57-0x0000000000660000-0x000000000066C000-memory.dmp

Filesize
48KB

Download
memory/1488-58-0x0000000007EF0000-0x0000000007F84000-memory.dmp

Filesize
592KB

Download
memory/1488-59-0x00000000021E0000-0x000000000221A000-memory.dmp

Filesize
232KB

Download