2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28/10/2022, 19:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe
Size

129KB
MD5

0ab4246caf53e5a84d79a5d74d917bb0
SHA1

7d2b8c011e8933ed7600ce0f90cc89f8db8abbae
SHA256

2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee
SHA512

78511860b6f112bcde5d9f2619ca5919862993874c50e8f0c9bb67a7123dbd03c40fc090034616f53195fa71a11a10d817113927f322ba8a95c28df84c1d4bed
SSDEEP

3072:TgWON7RZ9WfrhPZuvs86Q+QN4OLujIXnZl4JH4epv5yrBkvg:wN7RZ9Wft5QY8iJYepBv

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe

Suspicious behavior: MapViewOfSection 22 IoCs

pid	Process
1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe
1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe
1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe
1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe
1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe
1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe
1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe
1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe
1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe
1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe
1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe
1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe
1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe
1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe
1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe
1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe
1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe
1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe
1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe
1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe
1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe
1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 368	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	5
PID 1980 wrote to memory of 368	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	5
PID 1980 wrote to memory of 368	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	5
PID 1980 wrote to memory of 368	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	5
PID 1980 wrote to memory of 368	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	5
PID 1980 wrote to memory of 368	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	5
PID 1980 wrote to memory of 368	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	5
PID 1980 wrote to memory of 380	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	4
PID 1980 wrote to memory of 380	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	4
PID 1980 wrote to memory of 380	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	4
PID 1980 wrote to memory of 380	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	4
PID 1980 wrote to memory of 380	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	4
PID 1980 wrote to memory of 380	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	4
PID 1980 wrote to memory of 380	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	4
PID 1980 wrote to memory of 416	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	3
PID 1980 wrote to memory of 416	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	3
PID 1980 wrote to memory of 416	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	3
PID 1980 wrote to memory of 416	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	3
PID 1980 wrote to memory of 416	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	3
PID 1980 wrote to memory of 416	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	3
PID 1980 wrote to memory of 416	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	3
PID 1980 wrote to memory of 460	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	2
PID 1980 wrote to memory of 460	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	2
PID 1980 wrote to memory of 460	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	2
PID 1980 wrote to memory of 460	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	2
PID 1980 wrote to memory of 460	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	2
PID 1980 wrote to memory of 460	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	2
PID 1980 wrote to memory of 460	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	2
PID 1980 wrote to memory of 476	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	1
PID 1980 wrote to memory of 476	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	1
PID 1980 wrote to memory of 476	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	1
PID 1980 wrote to memory of 476	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	1
PID 1980 wrote to memory of 476	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	1
PID 1980 wrote to memory of 476	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	1
PID 1980 wrote to memory of 476	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	1
PID 1980 wrote to memory of 484	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	27
PID 1980 wrote to memory of 484	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	27
PID 1980 wrote to memory of 484	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	27
PID 1980 wrote to memory of 484	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	27
PID 1980 wrote to memory of 484	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	27
PID 1980 wrote to memory of 484	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	27
PID 1980 wrote to memory of 484	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	27
PID 1980 wrote to memory of 580	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	8
PID 1980 wrote to memory of 580	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	8
PID 1980 wrote to memory of 580	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	8
PID 1980 wrote to memory of 580	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	8
PID 1980 wrote to memory of 580	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	8
PID 1980 wrote to memory of 580	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	8
PID 1980 wrote to memory of 580	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	8
PID 1980 wrote to memory of 656	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	26
PID 1980 wrote to memory of 656	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	26
PID 1980 wrote to memory of 656	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	26
PID 1980 wrote to memory of 656	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	26
PID 1980 wrote to memory of 656	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	26
PID 1980 wrote to memory of 656	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	26
PID 1980 wrote to memory of 656	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	26
PID 1980 wrote to memory of 720	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	25
PID 1980 wrote to memory of 720	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	25
PID 1980 wrote to memory of 720	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	25
PID 1980 wrote to memory of 720	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	25
PID 1980 wrote to memory of 720	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	25
PID 1980 wrote to memory of 720	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	25
PID 1980 wrote to memory of 720	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	25
PID 1980 wrote to memory of 788	1980	2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe	24

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:476

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:460
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:580
- - C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    3⤵
    PID:1912
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:952
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:964
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1192
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1036
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:360
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:296
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:860
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:836
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:788
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:720
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:656

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:416

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:380

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:368
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:484

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:1956

C:\Users\Admin\AppData\Local\Temp\2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe
"C:\Users\Admin\AppData\Local\Temp\2052ebef5f935697635ff80eca8f0d3ac95a652e529fc579c73fae5b70ae52ee.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1980

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1324

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1272

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1980-54-0x0000000001000000-0x0000000001025000-memory.dmp

Filesize
148KB

Download