3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6

Analysis

max time kernel
48s
max time network
53s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 05:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe
Size

155KB
MD5

601dcd1d7f428fba116b7db6ee53a67f
SHA1

020a828516eb702f356acdba0df908f72bc3fff0
SHA256

3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6
SHA512

04dbcb191699e1f391941c2ab14f31d5c28a46e6eb4fdba9fcfeecca048a8de0935ab6f709a88230b8fa429a7a226757a251fbf558e6ee8f9ad4d1b397735dd6
SSDEEP

3072:6KCNTpuILvBicQ6/uOCsf057v3s1SlsH1yR8:6vNTkcl/uOCsf054uWyq

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1460-69-0x0000000001000000-0x0000000001050000-memory.dmp	upx
behavioral1/memory/1460-103-0x0000000001000000-0x0000000001050000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\SysWOW64\alg.exe	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 816	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	28
PID 1460 wrote to memory of 816	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	28
PID 1460 wrote to memory of 816	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	28
PID 1460 wrote to memory of 816	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	28
PID 1460 wrote to memory of 812	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	29
PID 1460 wrote to memory of 812	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	29
PID 1460 wrote to memory of 812	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	29
PID 1460 wrote to memory of 812	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	29
PID 1460 wrote to memory of 1728	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	30
PID 1460 wrote to memory of 1728	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	30
PID 1460 wrote to memory of 1728	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	30
PID 1460 wrote to memory of 1728	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	30
PID 1460 wrote to memory of 764	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	31
PID 1460 wrote to memory of 764	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	31
PID 1460 wrote to memory of 764	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	31
PID 1460 wrote to memory of 764	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	31
PID 1460 wrote to memory of 324	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	32
PID 1460 wrote to memory of 324	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	32
PID 1460 wrote to memory of 324	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	32
PID 1460 wrote to memory of 324	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	32
PID 1460 wrote to memory of 364	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	33
PID 1460 wrote to memory of 364	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	33
PID 1460 wrote to memory of 364	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	33
PID 1460 wrote to memory of 364	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	33
PID 1460 wrote to memory of 1756	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	34
PID 1460 wrote to memory of 1756	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	34
PID 1460 wrote to memory of 1756	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	34
PID 1460 wrote to memory of 1756	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	34
PID 1460 wrote to memory of 1692	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	35
PID 1460 wrote to memory of 1692	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	35
PID 1460 wrote to memory of 1692	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	35
PID 1460 wrote to memory of 1692	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	35
PID 1460 wrote to memory of 524	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	36
PID 1460 wrote to memory of 524	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	36
PID 1460 wrote to memory of 524	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	36
PID 1460 wrote to memory of 524	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	36
PID 1460 wrote to memory of 580	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	37
PID 1460 wrote to memory of 580	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	37
PID 1460 wrote to memory of 580	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	37
PID 1460 wrote to memory of 580	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	37
PID 1460 wrote to memory of 1732	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	38
PID 1460 wrote to memory of 1732	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	38
PID 1460 wrote to memory of 1732	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	38
PID 1460 wrote to memory of 1732	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	38
PID 1460 wrote to memory of 1708	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	39
PID 1460 wrote to memory of 1708	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	39
PID 1460 wrote to memory of 1708	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	39
PID 1460 wrote to memory of 1708	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	39
PID 1460 wrote to memory of 1472	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	41
PID 1460 wrote to memory of 1472	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	41
PID 1460 wrote to memory of 1472	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	41
PID 1460 wrote to memory of 1472	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	41
PID 1460 wrote to memory of 1672	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	40
PID 1460 wrote to memory of 1672	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	40
PID 1460 wrote to memory of 1672	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	40
PID 1460 wrote to memory of 1672	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	40
PID 1460 wrote to memory of 1752	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	42
PID 1460 wrote to memory of 1752	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	42
PID 1460 wrote to memory of 1752	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	42
PID 1460 wrote to memory of 1752	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	42
PID 1460 wrote to memory of 568	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	43
PID 1460 wrote to memory of 568	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	43
PID 1460 wrote to memory of 568	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	43
PID 1460 wrote to memory of 568	1460	3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe	43

C:\Users\Admin\AppData\Local\Temp\3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe
"C:\Users\Admin\AppData\Local\Temp\3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Windows\SysWOW64\cmd.exe
  /c echo "19332042-4f3d-4265-9c23-c52b517947e9.tmp"
  2⤵
  PID:816
- C:\Windows\SysWOW64\cmd.exe
  /c echo "3034ab626093c71971c60166fb8bf3b9271dea010a1c53cc2bafc9e6157e3ab6.exe"
  2⤵
  PID:812
- C:\Windows\SysWOW64\cmd.exe
  /c echo "3460099317"
  2⤵
  PID:1728
- C:\Windows\SysWOW64\cmd.exe
  /c echo "35675940-12ea-43e6-9a29-2fde6cdfd31c.tmp"
  2⤵
  PID:764
- C:\Windows\SysWOW64\cmd.exe
  /c echo "4ced5ba9-fb64-4b4f-9d15-e20e648456ab.tmp"
  2⤵
  PID:324
- C:\Windows\SysWOW64\cmd.exe
  /c echo "68c96edb-4338-4ded-8ac6-4ae2ce43119b.tmp"
  2⤵
  PID:364
- C:\Windows\SysWOW64\cmd.exe
  /c echo "795ddf6f-7912-4640-8ac1-2353a7f0ea89.tmp"
  2⤵
  PID:1756
- C:\Windows\SysWOW64\cmd.exe
  /c echo "Admin.bmp"
  2⤵
  PID:1692
- C:\Windows\SysWOW64\cmd.exe
  /c echo "ASPNETSetup_00000.log"
  2⤵
  PID:524
- C:\Windows\SysWOW64\cmd.exe
  /c echo "ASPNETSetup_00001.log"
  2⤵
  PID:580
- C:\Windows\SysWOW64\cmd.exe
  /c echo "b684c365-a914-4e5f-a38a-bb5b0b40a917.tmp"
  2⤵
  PID:1732
- C:\Windows\SysWOW64\cmd.exe
  /c echo "chrome_installer.log"
  2⤵
  PID:1708
- C:\Windows\SysWOW64\cmd.exe
  /c echo "dd_SetupUtility.txt"
  2⤵
  PID:1672
- C:\Windows\SysWOW64\cmd.exe
  /c echo "dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt"
  2⤵
  PID:1472
- C:\Windows\SysWOW64\cmd.exe
  /c echo "dd_vcredistMSI640E.txt"
  2⤵
  PID:1752
- C:\Windows\SysWOW64\cmd.exe
  /c echo "dd_vcredistMSI6476.txt"
  2⤵
  PID:568
- C:\Windows\SysWOW64\cmd.exe
  /c echo "dd_vcredistUI640E.txt"
  2⤵
  PID:1656
- C:\Windows\SysWOW64\cmd.exe
  /c echo "dd_vcredistUI6476.txt"
  2⤵
  PID:1480
- C:\Windows\SysWOW64\cmd.exe
  /c echo "dd_wcf_CA_smci_20220901_133527_258.txt"
  2⤵
  PID:1056
- C:\Windows\SysWOW64\cmd.exe
  /c echo "dd_wcf_CA_smci_20220901_133528_724.txt"
  2⤵
  PID:1100
- C:\Windows\SysWOW64\cmd.exe
  /c echo "f337ec5d-de05-4a2e-8405-50027a596b4f.tmp"
  2⤵
  PID:316
- C:\Windows\SysWOW64\cmd.exe
  /c echo "e2431e2a-8066-4d94-bbc3-b73a76ab1f0f.tmp"
  2⤵
  PID:1316
- C:\Windows\SysWOW64\cmd.exe
  /c echo "FXSAPIDebugLogFile.txt"
  2⤵
  PID:1296
- C:\Windows\SysWOW64\cmd.exe
  /c echo "hsperfdata_Admin"
  2⤵
  PID:1680
- C:\Windows\SysWOW64\cmd.exe
  /c echo "JavaDeployReg.log"
  2⤵
  PID:1772
- C:\Windows\SysWOW64\cmd.exe
  /c echo "java_install.log"
  2⤵
  PID:1048
- C:\Windows\SysWOW64\cmd.exe
  /c echo "java_install_reg.log"
  2⤵
  PID:1852
- C:\Windows\SysWOW64\cmd.exe
  /c echo "jawshtml.html"
  2⤵
  PID:1920
- C:\Windows\SysWOW64\cmd.exe
  /c echo "jusched.log"
  2⤵
  PID:2044
- C:\Windows\SysWOW64\cmd.exe
  /c echo "Low"
  2⤵
  PID:1192
- C:\Windows\SysWOW64\cmd.exe
  /c echo "lpksetup-20220901-135047-0.log"
  2⤵
  PID:1244
- C:\Windows\SysWOW64\cmd.exe
  /c echo "lpksetup-20220901-135352-0.log"
  2⤵
  PID:1688
- C:\Windows\SysWOW64\cmd.exe
  /c echo "lpksetup-20220901-135651-0.log"
  2⤵
  PID:1952
- C:\Windows\SysWOW64\cmd.exe
  /c echo "lpksetup-20220901-135957-0.log"
  2⤵
  PID:964
- C:\Windows\SysWOW64\cmd.exe
  /c echo "lpksetup-20220901-140302-0.log"
  2⤵
  PID:928
- C:\Windows\SysWOW64\cmd.exe
  /c echo "Microsoft .NET Framework 4.7.2 Setup_20220901_133503561-MSI_netfx_Full_x64.msi.txt"
  2⤵
  PID:1676
- C:\Windows\SysWOW64\cmd.exe
  /c echo "Microsoft .NET Framework 4.7.2 Setup_20220901_133503561.html"
  2⤵
  PID:1364
- C:\Windows\SysWOW64\cmd.exe
  /c echo "Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219"
  2⤵
  PID:1720
- C:\Windows\SysWOW64\cmd.exe
  /c echo "Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219"
  2⤵
  PID:2000
- C:\Windows\SysWOW64\cmd.exe
  /c echo "mozilla-temp-files"
  2⤵
  PID:988
- C:\Windows\SysWOW64\cmd.exe
  /c echo "ose00000.exe"
  2⤵
  PID:1324
- C:\Windows\SysWOW64\cmd.exe
  /c echo "RDE993.tmp"
  2⤵
  PID:692
- C:\Windows\SysWOW64\cmd.exe
  /c echo "RGI24D0.tmp"
  2⤵
  PID:1256
- C:\Windows\SysWOW64\cmd.exe
  /c echo "RGI24D0.tmp-tmp"
  2⤵
  PID:1584
- C:\Windows\SysWOW64\cmd.exe
  /c echo "SetupExe(20220901134306790).log"
  2⤵
  PID:880
- C:\Windows\SysWOW64\cmd.exe
  /c echo "wmsetup.log"
  2⤵
  PID:1456
- C:\Windows\SysWOW64\cmd.exe
  /c echo "WPDNSE"
  2⤵
  PID:2024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1460-69-0x0000000001000000-0x0000000001050000-memory.dmp

Filesize
320KB

Download
memory/1460-103-0x0000000001000000-0x0000000001050000-memory.dmp

Filesize
320KB

Download
memory/1460-85-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download