51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3

Analysis

max time kernel
6s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-10-2022 03:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe
Size

41KB
MD5

64d2c01412eb89550f76e6a3deac5939
SHA1

d47decb8613fcff767b13e0418f2ffd4b7554d93
SHA256

51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3
SHA512

6679388122dcdfd19abfd3d351b49ec914ee1dfd60f7f29e8059967d90aa7b6054206e4174560ce5031d5ede917ceb2e375dd947251ff010bc0b80a89573c413
SSDEEP

768:KLedqHzAz0JSvrhwGhzQXQAdl4zEsTxOSHEauDJFWYOzLZlG6EQT:H+ivrbzxClAE0OSHEvXmlEQT

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe

Suspicious behavior: MapViewOfSection 23 IoCs

pid	Process
608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe
608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe
608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe
608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe
608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe
608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe
608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe
608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe
608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe
608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe
608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe
608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe
608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe
608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe
608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe
608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe
608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe
608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe
608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe
608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe
608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe
608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe
608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 608 wrote to memory of 368	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	5
PID 608 wrote to memory of 368	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	5
PID 608 wrote to memory of 368	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	5
PID 608 wrote to memory of 368	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	5
PID 608 wrote to memory of 368	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	5
PID 608 wrote to memory of 368	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	5
PID 608 wrote to memory of 368	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	5
PID 608 wrote to memory of 384	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	4
PID 608 wrote to memory of 384	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	4
PID 608 wrote to memory of 384	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	4
PID 608 wrote to memory of 384	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	4
PID 608 wrote to memory of 384	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	4
PID 608 wrote to memory of 384	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	4
PID 608 wrote to memory of 384	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	4
PID 608 wrote to memory of 420	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	3
PID 608 wrote to memory of 420	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	3
PID 608 wrote to memory of 420	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	3
PID 608 wrote to memory of 420	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	3
PID 608 wrote to memory of 420	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	3
PID 608 wrote to memory of 420	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	3
PID 608 wrote to memory of 420	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	3
PID 608 wrote to memory of 464	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	2
PID 608 wrote to memory of 464	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	2
PID 608 wrote to memory of 464	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	2
PID 608 wrote to memory of 464	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	2
PID 608 wrote to memory of 464	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	2
PID 608 wrote to memory of 464	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	2
PID 608 wrote to memory of 464	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	2
PID 608 wrote to memory of 480	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	1
PID 608 wrote to memory of 480	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	1
PID 608 wrote to memory of 480	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	1
PID 608 wrote to memory of 480	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	1
PID 608 wrote to memory of 480	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	1
PID 608 wrote to memory of 480	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	1
PID 608 wrote to memory of 480	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	1
PID 608 wrote to memory of 488	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	8
PID 608 wrote to memory of 488	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	8
PID 608 wrote to memory of 488	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	8
PID 608 wrote to memory of 488	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	8
PID 608 wrote to memory of 488	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	8
PID 608 wrote to memory of 488	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	8
PID 608 wrote to memory of 488	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	8
PID 608 wrote to memory of 596	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	27
PID 608 wrote to memory of 596	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	27
PID 608 wrote to memory of 596	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	27
PID 608 wrote to memory of 596	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	27
PID 608 wrote to memory of 596	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	27
PID 608 wrote to memory of 596	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	27
PID 608 wrote to memory of 596	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	27
PID 608 wrote to memory of 672	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	26
PID 608 wrote to memory of 672	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	26
PID 608 wrote to memory of 672	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	26
PID 608 wrote to memory of 672	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	26
PID 608 wrote to memory of 672	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	26
PID 608 wrote to memory of 672	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	26
PID 608 wrote to memory of 672	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	26
PID 608 wrote to memory of 756	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	25
PID 608 wrote to memory of 756	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	25
PID 608 wrote to memory of 756	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	25
PID 608 wrote to memory of 756	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	25
PID 608 wrote to memory of 756	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	25
PID 608 wrote to memory of 756	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	25
PID 608 wrote to memory of 756	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	25
PID 608 wrote to memory of 820	608	51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe	9

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:480

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:464
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:820
- - C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    3⤵
    PID:1316
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1248
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:1112
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:1172
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1036
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:328
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:336
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:892
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:856
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:756
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:672
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:596

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:384
- C:\Windows\system32\conhost.exe
  \??\C:\Windows\system32\conhost.exe "-896320395-77617795928886066-7603354532678941992059585062-713211726-539040378"
  2⤵
  PID:804

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:368
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:488

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:2036

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:1972

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1372
- C:\Users\Admin\AppData\Local\Temp\51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe
  "C:\Users\Admin\AppData\Local\Temp\51117ac4e2a7f0e3abc135c0fe78efff0aabcbdf4b4b89a8aac3d107dbcdf5c3.exe"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:608

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/608-54-0x0000000001000000-0x000000000100F000-memory.dmp

Filesize
60KB

Download