Analysis
-
max time kernel
54s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
04-10-2022 01:39
Static task
static1
Behavioral task
behavioral1
Sample
97af4157796dfb09c3bd51c4988c4bac1b0a6210256e266cc2f4236bccc9f5d9.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
97af4157796dfb09c3bd51c4988c4bac1b0a6210256e266cc2f4236bccc9f5d9.exe
Resource
win10v2004-20220901-en
General
-
Target
97af4157796dfb09c3bd51c4988c4bac1b0a6210256e266cc2f4236bccc9f5d9.exe
-
Size
255KB
-
MD5
692cc299413a63e12db0be146ad906e0
-
SHA1
6f2c1dc4b26c21784f9ee4fb850abad30d4e0850
-
SHA256
97af4157796dfb09c3bd51c4988c4bac1b0a6210256e266cc2f4236bccc9f5d9
-
SHA512
674c4c9502b91ed9d445e058c6ce69eb301ece610b99d73fbce9ba143fde2d862b3677ab378a319cbbdc8fb3000ae3996a0f64c329e4dbc3ed44e79504cfd505
-
SSDEEP
6144:bvAEij0W9CjZKtA547QBrdrpw6Eqt1pNJP:bvADjojU6WUdrqzKJP
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
97af4157796dfb09c3bd51c4988c4bac1b0a6210256e266cc2f4236bccc9f5d9.exepid process 1208 97af4157796dfb09c3bd51c4988c4bac1b0a6210256e266cc2f4236bccc9f5d9.exe 1208 97af4157796dfb09c3bd51c4988c4bac1b0a6210256e266cc2f4236bccc9f5d9.exe 1208 97af4157796dfb09c3bd51c4988c4bac1b0a6210256e266cc2f4236bccc9f5d9.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
97af4157796dfb09c3bd51c4988c4bac1b0a6210256e266cc2f4236bccc9f5d9.exedescription pid process Token: SeDebugPrivilege 1208 97af4157796dfb09c3bd51c4988c4bac1b0a6210256e266cc2f4236bccc9f5d9.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
97af4157796dfb09c3bd51c4988c4bac1b0a6210256e266cc2f4236bccc9f5d9.exedescription pid process target process PID 1208 wrote to memory of 5024 1208 97af4157796dfb09c3bd51c4988c4bac1b0a6210256e266cc2f4236bccc9f5d9.exe 97af4157796dfb09c3bd51c4988c4bac1b0a6210256e266cc2f4236bccc9f5d9.exe PID 1208 wrote to memory of 5024 1208 97af4157796dfb09c3bd51c4988c4bac1b0a6210256e266cc2f4236bccc9f5d9.exe 97af4157796dfb09c3bd51c4988c4bac1b0a6210256e266cc2f4236bccc9f5d9.exe PID 1208 wrote to memory of 5024 1208 97af4157796dfb09c3bd51c4988c4bac1b0a6210256e266cc2f4236bccc9f5d9.exe 97af4157796dfb09c3bd51c4988c4bac1b0a6210256e266cc2f4236bccc9f5d9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\97af4157796dfb09c3bd51c4988c4bac1b0a6210256e266cc2f4236bccc9f5d9.exe"C:\Users\Admin\AppData\Local\Temp\97af4157796dfb09c3bd51c4988c4bac1b0a6210256e266cc2f4236bccc9f5d9.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\97af4157796dfb09c3bd51c4988c4bac1b0a6210256e266cc2f4236bccc9f5d9.exeC:\Users\Admin\AppData\Local\Temp\97af4157796dfb09c3bd51c4988c4bac1b0a6210256e266cc2f4236bccc9f5d9.exe2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1208-132-0x00000000003B0000-0x00000000003F6000-memory.dmpFilesize
280KB
-
memory/1208-133-0x0000000007AB0000-0x0000000008054000-memory.dmpFilesize
5.6MB
-
memory/1208-134-0x00000000075E0000-0x0000000007672000-memory.dmpFilesize
584KB
-
memory/1208-135-0x0000000007720000-0x00000000077BC000-memory.dmpFilesize
624KB
-
memory/1208-136-0x00000000075D0000-0x00000000075DA000-memory.dmpFilesize
40KB
-
memory/5024-137-0x0000000000000000-mapping.dmp