868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 01:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe
Size

79KB
MD5

93bb18610cc0393db33e245947eed310
SHA1

cf045e306edb87b5b30d5a51944d6ee2008ff23c
SHA256

868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da
SHA512

c62373fbbdf4dacd17907cae726a9398b8c9a883b9bcf99e66a6244907bfe43ec87206bcd44e8efd9bdbaa56f317fe52385f5c664519a6ff8085c85dfabf1504
SSDEEP

768:TL2mYzyN7c9SKiGsU8fKKVuJvSHlNyHg95fppQ+PIvnf6RolUcfnhGgYPLvmj:XsGN7c9SKiGN8fzplNyHm5pwNt

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1188	gemuas.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\gemuas.exe	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe
File opened for modification	C:\WINDOWS\SysWOW64\GEMUAS.EXE	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe
File opened for modification	C:\Windows\SysWOW64\gemuas.exe	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1188 set thread context of 764	1188	gemuas.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe

Suspicious behavior: MapViewOfSection 21 IoCs

pid	Process
620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe
620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe
620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe
620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe
620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe
620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe
620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe
620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe
620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe
620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe
620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe
620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe
620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe
620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe
620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe
620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe
620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe
620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe
620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe
620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe
620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe
Token: SeTakeOwnershipPrivilege	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe
Token: SeRestorePrivilege	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe
Token: SeBackupPrivilege	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe
Token: SeChangeNotifyPrivilege	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe
Token: SeTakeOwnershipPrivilege	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe
Token: SeRestorePrivilege	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe
Token: SeBackupPrivilege	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe
Token: SeChangeNotifyPrivilege	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe
Token: SeTakeOwnershipPrivilege	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe
Token: SeRestorePrivilege	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe
Token: SeBackupPrivilege	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe
Token: SeChangeNotifyPrivilege	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe
Token: SeTakeOwnershipPrivilege	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe
Token: SeRestorePrivilege	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe
Token: SeBackupPrivilege	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe
Token: SeChangeNotifyPrivilege	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe
Token: SeIncBasePriorityPrivilege	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 620 wrote to memory of 372	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	5
PID 620 wrote to memory of 372	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	5
PID 620 wrote to memory of 372	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	5
PID 620 wrote to memory of 372	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	5
PID 620 wrote to memory of 372	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	5
PID 620 wrote to memory of 384	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	4
PID 620 wrote to memory of 384	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	4
PID 620 wrote to memory of 384	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	4
PID 620 wrote to memory of 384	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	4
PID 620 wrote to memory of 384	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	4
PID 620 wrote to memory of 420	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	3
PID 620 wrote to memory of 420	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	3
PID 620 wrote to memory of 420	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	3
PID 620 wrote to memory of 420	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	3
PID 620 wrote to memory of 420	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	3
PID 620 wrote to memory of 464	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	2
PID 620 wrote to memory of 464	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	2
PID 620 wrote to memory of 464	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	2
PID 620 wrote to memory of 464	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	2
PID 620 wrote to memory of 464	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	2
PID 620 wrote to memory of 480	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	1
PID 620 wrote to memory of 480	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	1
PID 620 wrote to memory of 480	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	1
PID 620 wrote to memory of 480	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	1
PID 620 wrote to memory of 480	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	1
PID 620 wrote to memory of 488	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	8
PID 620 wrote to memory of 488	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	8
PID 620 wrote to memory of 488	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	8
PID 620 wrote to memory of 488	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	8
PID 620 wrote to memory of 488	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	8
PID 620 wrote to memory of 592	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	25
PID 620 wrote to memory of 592	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	25
PID 620 wrote to memory of 592	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	25
PID 620 wrote to memory of 592	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	25
PID 620 wrote to memory of 592	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	25
PID 620 wrote to memory of 668	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	24
PID 620 wrote to memory of 668	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	24
PID 620 wrote to memory of 668	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	24
PID 620 wrote to memory of 668	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	24
PID 620 wrote to memory of 668	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	24
PID 620 wrote to memory of 752	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	23
PID 620 wrote to memory of 752	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	23
PID 620 wrote to memory of 752	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	23
PID 620 wrote to memory of 752	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	23
PID 620 wrote to memory of 752	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	23
PID 620 wrote to memory of 804	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	9
PID 620 wrote to memory of 804	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	9
PID 620 wrote to memory of 804	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	9
PID 620 wrote to memory of 804	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	9
PID 620 wrote to memory of 804	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	9
PID 620 wrote to memory of 840	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	22
PID 620 wrote to memory of 840	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	22
PID 620 wrote to memory of 840	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	22
PID 620 wrote to memory of 840	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	22
PID 620 wrote to memory of 840	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	22
PID 620 wrote to memory of 884	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	21
PID 620 wrote to memory of 884	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	21
PID 620 wrote to memory of 884	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	21
PID 620 wrote to memory of 884	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	21
PID 620 wrote to memory of 884	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	21
PID 620 wrote to memory of 340	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	20
PID 620 wrote to memory of 340	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	20
PID 620 wrote to memory of 340	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	20
PID 620 wrote to memory of 340	620	868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe	20

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:480

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:464
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:804
- - C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    3⤵
    PID:1168
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1080
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:1656
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:1788
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1108
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:836
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:340
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:884
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:840
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:752
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:668
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:592
- C:\Windows\SysWOW64\gemuas.exe
  C:\Windows\SysWOW64\gemuas.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:1188
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:764

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:384

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:372
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:488

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:2012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1192
- C:\Users\Admin\AppData\Local\Temp\868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe
  "C:\Users\Admin\AppData\Local\Temp\868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\gemuas.exe

Filesize
79KB

MD5
93bb18610cc0393db33e245947eed310

SHA1
cf045e306edb87b5b30d5a51944d6ee2008ff23c

SHA256
868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da

SHA512
c62373fbbdf4dacd17907cae726a9398b8c9a883b9bcf99e66a6244907bfe43ec87206bcd44e8efd9bdbaa56f317fe52385f5c664519a6ff8085c85dfabf1504

Download Submit
C:\Windows\SysWOW64\gemuas.exe

Filesize
79KB

MD5
93bb18610cc0393db33e245947eed310

SHA1
cf045e306edb87b5b30d5a51944d6ee2008ff23c

SHA256
868a7ca27a443076b2df3900b6b453954e25cbec9811cf4678e6c888a58dd1da

SHA512
c62373fbbdf4dacd17907cae726a9398b8c9a883b9bcf99e66a6244907bfe43ec87206bcd44e8efd9bdbaa56f317fe52385f5c664519a6ff8085c85dfabf1504

Download Submit
memory/620-54-0x0000000075711000-0x0000000075713000-memory.dmp

Filesize
8KB

Download
memory/620-62-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/620-64-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/764-60-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/764-58-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1188-63-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download