753a19146cb4daec0e57cacdb927bed5574938b298dbfb97109a2c6cbc05d3e3

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19/10/2022, 22:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

753a19146cb4daec0e57cacdb927bed5574938b298dbfb97109a2c6cbc05d3e3.exe
Size

55KB
MD5

924aa0f25a06b546ca3e3ab428b0db10
SHA1

3b51c7eb3a64fe8d795570843cda0229a66f4ef0
SHA256

753a19146cb4daec0e57cacdb927bed5574938b298dbfb97109a2c6cbc05d3e3
SHA512

3c1dd35768a99490e393cbcffe5e67f65fe09066b2bf40281e9cde62ef8d0d58977ef66d22b124b9339d26f68d94e31e6ef0d29dd368c27372307db0315edc14
SSDEEP

768:dJ9rgBZyD4+abanIJqs7ZOyfDi9r13PMOZ/:djFk/banI0s7ZOqDQJ

Score

1^/10

Malware Config

Signatures

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1456	753a19146cb4daec0e57cacdb927bed5574938b298dbfb97109a2c6cbc05d3e3.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1456	753a19146cb4daec0e57cacdb927bed5574938b298dbfb97109a2c6cbc05d3e3.exe
Token: SeDebugPrivilege	1528	753a19146cb4daec0e57cacdb927bed5574938b298dbfb97109a2c6cbc05d3e3.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1456	753a19146cb4daec0e57cacdb927bed5574938b298dbfb97109a2c6cbc05d3e3.exe
1528	753a19146cb4daec0e57cacdb927bed5574938b298dbfb97109a2c6cbc05d3e3.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 1528	1456	753a19146cb4daec0e57cacdb927bed5574938b298dbfb97109a2c6cbc05d3e3.exe	26
PID 1456 wrote to memory of 1528	1456	753a19146cb4daec0e57cacdb927bed5574938b298dbfb97109a2c6cbc05d3e3.exe	26
PID 1456 wrote to memory of 1528	1456	753a19146cb4daec0e57cacdb927bed5574938b298dbfb97109a2c6cbc05d3e3.exe	26
PID 1456 wrote to memory of 1528	1456	753a19146cb4daec0e57cacdb927bed5574938b298dbfb97109a2c6cbc05d3e3.exe	26
PID 1528 wrote to memory of 1324	1528	753a19146cb4daec0e57cacdb927bed5574938b298dbfb97109a2c6cbc05d3e3.exe	27
PID 1528 wrote to memory of 1324	1528	753a19146cb4daec0e57cacdb927bed5574938b298dbfb97109a2c6cbc05d3e3.exe	27
PID 1528 wrote to memory of 1324	1528	753a19146cb4daec0e57cacdb927bed5574938b298dbfb97109a2c6cbc05d3e3.exe	27
PID 1528 wrote to memory of 1324	1528	753a19146cb4daec0e57cacdb927bed5574938b298dbfb97109a2c6cbc05d3e3.exe	27
PID 1528 wrote to memory of 1324	1528	753a19146cb4daec0e57cacdb927bed5574938b298dbfb97109a2c6cbc05d3e3.exe	27
PID 1528 wrote to memory of 1324	1528	753a19146cb4daec0e57cacdb927bed5574938b298dbfb97109a2c6cbc05d3e3.exe	27
PID 1528 wrote to memory of 1324	1528	753a19146cb4daec0e57cacdb927bed5574938b298dbfb97109a2c6cbc05d3e3.exe	27
PID 1528 wrote to memory of 1324	1528	753a19146cb4daec0e57cacdb927bed5574938b298dbfb97109a2c6cbc05d3e3.exe	27
PID 1528 wrote to memory of 1324	1528	753a19146cb4daec0e57cacdb927bed5574938b298dbfb97109a2c6cbc05d3e3.exe	27
PID 1528 wrote to memory of 1324	1528	753a19146cb4daec0e57cacdb927bed5574938b298dbfb97109a2c6cbc05d3e3.exe	27
PID 1528 wrote to memory of 1324	1528	753a19146cb4daec0e57cacdb927bed5574938b298dbfb97109a2c6cbc05d3e3.exe	27
PID 1528 wrote to memory of 1324	1528	753a19146cb4daec0e57cacdb927bed5574938b298dbfb97109a2c6cbc05d3e3.exe	27

C:\Users\Admin\AppData\Local\Temp\753a19146cb4daec0e57cacdb927bed5574938b298dbfb97109a2c6cbc05d3e3.exe
"C:\Users\Admin\AppData\Local\Temp\753a19146cb4daec0e57cacdb927bed5574938b298dbfb97109a2c6cbc05d3e3.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1456
- C:\ProgramData\pcdfdata\753a19146cb4daec0e57cacdb927bed5574938b298dbfb97109a2c6cbc05d3e3.exe
  C:\ProgramData\pcdfdata\753a19146cb4daec0e57cacdb927bed5574938b298dbfb97109a2c6cbc05d3e3.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:1528
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:1324

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1456-54-0x0000000075B51000-0x0000000075B53000-memory.dmp

Filesize
8KB

Download
memory/1456-57-0x00000000001E0000-0x00000000001E8000-memory.dmp

Filesize
32KB

Download
memory/1456-58-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1528-60-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1528-59-0x0000000000250000-0x0000000000258000-memory.dmp

Filesize
32KB

Download
memory/1528-61-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads