f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769

Analysis

max time kernel
35s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 10:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe
Size

30KB
MD5

444b876fce6747dc06256dffe5d62920
SHA1

e6803cee428f5e5503b2757ccd9612691f8917c6
SHA256

f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769
SHA512

bc4df3807dc52fe0bfd0455ae3b4526a033051fa0a02d97942d155a676e44deaf364887efe176b43c49d518b0a96373e32cd604d913d75f6e05f52b582b5c47f
SSDEEP

384:oSEmyWUnWptIC+OZG9efNc+xcZUr/ChY1zfbiQQXIiS19FZc+z3vKNth3s6njqbh:/gOtf+zefZDrC0VQYiS0+zf4mb

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mapi32.dll	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe

Suspicious behavior: MapViewOfSection 22 IoCs

pid	Process
744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe
744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe
744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe
744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe
744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe
744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe
744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe
744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe
744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe
744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe
744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe
744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe
744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe
744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe
744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe
744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe
744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe
744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe
744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe
744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe
744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe
744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 372	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	2
PID 744 wrote to memory of 372	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	2
PID 744 wrote to memory of 372	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	2
PID 744 wrote to memory of 372	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	2
PID 744 wrote to memory of 372	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	2
PID 744 wrote to memory of 372	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	2
PID 744 wrote to memory of 372	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	2
PID 744 wrote to memory of 384	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	1
PID 744 wrote to memory of 384	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	1
PID 744 wrote to memory of 384	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	1
PID 744 wrote to memory of 384	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	1
PID 744 wrote to memory of 384	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	1
PID 744 wrote to memory of 384	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	1
PID 744 wrote to memory of 384	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	1
PID 744 wrote to memory of 420	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	7
PID 744 wrote to memory of 420	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	7
PID 744 wrote to memory of 420	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	7
PID 744 wrote to memory of 420	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	7
PID 744 wrote to memory of 420	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	7
PID 744 wrote to memory of 420	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	7
PID 744 wrote to memory of 420	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	7
PID 744 wrote to memory of 464	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	6
PID 744 wrote to memory of 464	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	6
PID 744 wrote to memory of 464	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	6
PID 744 wrote to memory of 464	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	6
PID 744 wrote to memory of 464	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	6
PID 744 wrote to memory of 464	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	6
PID 744 wrote to memory of 464	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	6
PID 744 wrote to memory of 484	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	5
PID 744 wrote to memory of 484	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	5
PID 744 wrote to memory of 484	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	5
PID 744 wrote to memory of 484	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	5
PID 744 wrote to memory of 484	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	5
PID 744 wrote to memory of 484	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	5
PID 744 wrote to memory of 484	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	5
PID 744 wrote to memory of 492	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	27
PID 744 wrote to memory of 492	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	27
PID 744 wrote to memory of 492	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	27
PID 744 wrote to memory of 492	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	27
PID 744 wrote to memory of 492	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	27
PID 744 wrote to memory of 492	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	27
PID 744 wrote to memory of 492	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	27
PID 744 wrote to memory of 592	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	26
PID 744 wrote to memory of 592	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	26
PID 744 wrote to memory of 592	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	26
PID 744 wrote to memory of 592	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	26
PID 744 wrote to memory of 592	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	26
PID 744 wrote to memory of 592	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	26
PID 744 wrote to memory of 592	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	26
PID 744 wrote to memory of 672	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	25
PID 744 wrote to memory of 672	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	25
PID 744 wrote to memory of 672	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	25
PID 744 wrote to memory of 672	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	25
PID 744 wrote to memory of 672	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	25
PID 744 wrote to memory of 672	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	25
PID 744 wrote to memory of 672	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	25
PID 744 wrote to memory of 756	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	8
PID 744 wrote to memory of 756	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	8
PID 744 wrote to memory of 756	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	8
PID 744 wrote to memory of 756	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	8
PID 744 wrote to memory of 756	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	8
PID 744 wrote to memory of 756	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	8
PID 744 wrote to memory of 756	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	8
PID 744 wrote to memory of 808	744	f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe	24

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:384

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:372
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:484
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:464
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:756
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:1760
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:1744
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1216
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1044
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:456
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:292
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:872
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:844
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:808
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:672
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:592
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:492

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:1952

C:\Users\Admin\AppData\Local\Temp\f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe
"C:\Users\Admin\AppData\Local\Temp\f1b9ef34f3d989f181fe78be803b5749cb88d2f25ec6daa814b6d4e5074c2769.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:744

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:1804

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1376

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1296

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/744-54-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download