b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603

Analysis

max time kernel
56s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-10-2022 21:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe
Size

118KB
MD5

82e4ef9ff404575a62da35dc95331e17
SHA1

d06292eaa5c16d1b96cc8013092fdec195490935
SHA256

b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603
SHA512

d4da42fc56ddf8a2ce2d9c1ab9676c5d11ccd0e1d7eec49d1ad3012a171793fcf1edbc8b76941547702d0f9cb510d806678cc1efb245ce408ab26f87f052c06b
SSDEEP

1536:A1WQg9RugdkRn+wTlk+Y8ijD0mFEZBrkAi:XQgDpdc+w1nif0mFCtJ

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\SysWOW64\NETSH.EXE	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe

Suspicious behavior: MapViewOfSection 22 IoCs

pid	Process
952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe
952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe
952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe
952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe
952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe
952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe
952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe
952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe
952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe
952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe
952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe
952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe
952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe
952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe
952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe
952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe
952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe
952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe
952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe
952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe
952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe
952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe
Token: SeTakeOwnershipPrivilege	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe
Token: SeRestorePrivilege	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe
Token: SeBackupPrivilege	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe
Token: SeChangeNotifyPrivilege	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 372	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	24
PID 952 wrote to memory of 372	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	24
PID 952 wrote to memory of 372	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	24
PID 952 wrote to memory of 372	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	24
PID 952 wrote to memory of 372	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	24
PID 952 wrote to memory of 372	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	24
PID 952 wrote to memory of 372	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	24
PID 952 wrote to memory of 384	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	23
PID 952 wrote to memory of 384	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	23
PID 952 wrote to memory of 384	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	23
PID 952 wrote to memory of 384	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	23
PID 952 wrote to memory of 384	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	23
PID 952 wrote to memory of 384	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	23
PID 952 wrote to memory of 384	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	23
PID 952 wrote to memory of 420	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	22
PID 952 wrote to memory of 420	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	22
PID 952 wrote to memory of 420	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	22
PID 952 wrote to memory of 420	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	22
PID 952 wrote to memory of 420	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	22
PID 952 wrote to memory of 420	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	22
PID 952 wrote to memory of 420	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	22
PID 952 wrote to memory of 464	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	2
PID 952 wrote to memory of 464	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	2
PID 952 wrote to memory of 464	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	2
PID 952 wrote to memory of 464	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	2
PID 952 wrote to memory of 464	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	2
PID 952 wrote to memory of 464	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	2
PID 952 wrote to memory of 464	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	2
PID 952 wrote to memory of 480	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	1
PID 952 wrote to memory of 480	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	1
PID 952 wrote to memory of 480	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	1
PID 952 wrote to memory of 480	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	1
PID 952 wrote to memory of 480	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	1
PID 952 wrote to memory of 480	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	1
PID 952 wrote to memory of 480	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	1
PID 952 wrote to memory of 488	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	21
PID 952 wrote to memory of 488	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	21
PID 952 wrote to memory of 488	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	21
PID 952 wrote to memory of 488	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	21
PID 952 wrote to memory of 488	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	21
PID 952 wrote to memory of 488	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	21
PID 952 wrote to memory of 488	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	21
PID 952 wrote to memory of 600	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	3
PID 952 wrote to memory of 600	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	3
PID 952 wrote to memory of 600	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	3
PID 952 wrote to memory of 600	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	3
PID 952 wrote to memory of 600	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	3
PID 952 wrote to memory of 600	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	3
PID 952 wrote to memory of 600	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	3
PID 952 wrote to memory of 680	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	20
PID 952 wrote to memory of 680	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	20
PID 952 wrote to memory of 680	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	20
PID 952 wrote to memory of 680	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	20
PID 952 wrote to memory of 680	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	20
PID 952 wrote to memory of 680	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	20
PID 952 wrote to memory of 680	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	20
PID 952 wrote to memory of 764	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	19
PID 952 wrote to memory of 764	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	19
PID 952 wrote to memory of 764	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	19
PID 952 wrote to memory of 764	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	19
PID 952 wrote to memory of 764	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	19
PID 952 wrote to memory of 764	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	19
PID 952 wrote to memory of 764	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	19
PID 952 wrote to memory of 812	952	b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe	18

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:480

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:464
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:600
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:1660
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:1044
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1124
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1084
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:1012
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:324
- - C:\Windows\system32\wininit.exe
    wininit.exe
    3⤵
    PID:372
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:880
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:852
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:812
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:764
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:680

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:2004

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1244
- C:\Users\Admin\AppData\Local\Temp\b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe
  "C:\Users\Admin\AppData\Local\Temp\b5d759aa0d31db7796fbebfe6e6d676a8618dad806938470df5a8b7f93dc2603.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:952

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1184

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:488

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:384
- C:\Windows\system32\conhost.exe
  \??\C:\Windows\system32\conhost.exe "-8507891141412526556111359436-605434253-1397646828-1780463213-5057499271296773842"
  2⤵
  PID:1552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\netsh.exe

Filesize
118KB

MD5
13e76378d376f70d0bc5d3770040c0b5

SHA1
5606092882bbe041f2a527306fb16dd412930ac5

SHA256
4436cbf0657f3bbcc1431eacad7bf79bf17e78da412ec6aeeb1b799295aef59d

SHA512
0e1aa2b3d60190c2ccd82db3b7432ea082ba28f21ca264a4d273ec2fa310837d206993f0e877964ca5326fb6c727c4047c7c8667b689198932b67e1b880ae267

Download Submit
memory/952-55-0x0000000001800000-0x0000000001822000-memory.dmp

Filesize
136KB

Download
memory/952-56-0x0000000000350000-0x0000000000372000-memory.dmp

Filesize
136KB

Download
memory/952-57-0x0000000075E11000-0x0000000075E13000-memory.dmp

Filesize
8KB

Download
memory/952-58-0x0000000001800000-0x0000000001822000-memory.dmp

Filesize
136KB

Download