80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 17:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe
Size

96KB
MD5

132d70f4e4a62409342d80a0c243db10
SHA1

0e4e478c2858fb36c5fad0aa895eab80936612cc
SHA256

80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20
SHA512

b9b618ceeda47a95c7ac962e06c11fcfb0ab5b724781b04143114fa2e6efea9abe1f4e23e6553a0e8ba544accf9bae2cf3240fbb70b0ae23aa5fd9c06a79b28a
SSDEEP

1536:3m3tuSJ2ZKGpXVyPI3ooPl5yd3JEKHjSXQVLu8YFnUjA8w:3m3UhHSKfPl5yhWi7VLu8YFd

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe

Suspicious behavior: MapViewOfSection 22 IoCs

pid	Process
536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe
536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe
536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe
536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe
536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe
536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe
536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe
536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe
536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe
536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe
536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe
536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe
536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe
536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe
536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe
536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe
536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe
536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe
536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe
536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe
536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe
536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 368	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	5
PID 536 wrote to memory of 368	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	5
PID 536 wrote to memory of 368	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	5
PID 536 wrote to memory of 368	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	5
PID 536 wrote to memory of 368	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	5
PID 536 wrote to memory of 368	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	5
PID 536 wrote to memory of 368	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	5
PID 536 wrote to memory of 384	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	4
PID 536 wrote to memory of 384	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	4
PID 536 wrote to memory of 384	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	4
PID 536 wrote to memory of 384	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	4
PID 536 wrote to memory of 384	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	4
PID 536 wrote to memory of 384	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	4
PID 536 wrote to memory of 384	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	4
PID 536 wrote to memory of 420	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	3
PID 536 wrote to memory of 420	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	3
PID 536 wrote to memory of 420	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	3
PID 536 wrote to memory of 420	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	3
PID 536 wrote to memory of 420	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	3
PID 536 wrote to memory of 420	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	3
PID 536 wrote to memory of 420	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	3
PID 536 wrote to memory of 464	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	2
PID 536 wrote to memory of 464	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	2
PID 536 wrote to memory of 464	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	2
PID 536 wrote to memory of 464	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	2
PID 536 wrote to memory of 464	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	2
PID 536 wrote to memory of 464	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	2
PID 536 wrote to memory of 464	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	2
PID 536 wrote to memory of 480	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	1
PID 536 wrote to memory of 480	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	1
PID 536 wrote to memory of 480	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	1
PID 536 wrote to memory of 480	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	1
PID 536 wrote to memory of 480	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	1
PID 536 wrote to memory of 480	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	1
PID 536 wrote to memory of 480	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	1
PID 536 wrote to memory of 488	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	8
PID 536 wrote to memory of 488	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	8
PID 536 wrote to memory of 488	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	8
PID 536 wrote to memory of 488	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	8
PID 536 wrote to memory of 488	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	8
PID 536 wrote to memory of 488	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	8
PID 536 wrote to memory of 488	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	8
PID 536 wrote to memory of 600	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	26
PID 536 wrote to memory of 600	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	26
PID 536 wrote to memory of 600	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	26
PID 536 wrote to memory of 600	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	26
PID 536 wrote to memory of 600	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	26
PID 536 wrote to memory of 600	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	26
PID 536 wrote to memory of 600	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	26
PID 536 wrote to memory of 676	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	25
PID 536 wrote to memory of 676	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	25
PID 536 wrote to memory of 676	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	25
PID 536 wrote to memory of 676	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	25
PID 536 wrote to memory of 676	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	25
PID 536 wrote to memory of 676	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	25
PID 536 wrote to memory of 676	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	25
PID 536 wrote to memory of 760	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	24
PID 536 wrote to memory of 760	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	24
PID 536 wrote to memory of 760	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	24
PID 536 wrote to memory of 760	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	24
PID 536 wrote to memory of 760	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	24
PID 536 wrote to memory of 760	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	24
PID 536 wrote to memory of 760	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	24
PID 536 wrote to memory of 820	536	80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe	23

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:480

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:464
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:1092
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:756
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1148
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1056
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:328
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:284
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:884
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:860
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:820
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:760
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:676
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:600

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:384

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:368
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:488

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:1928

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:2000

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1276
- C:\Users\Admin\AppData\Local\Temp\80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe
  "C:\Users\Admin\AppData\Local\Temp\80b90d47752d5eabf0a34ab86e263c149a9d90b8458470fa813a7ec44caa8d20.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:536

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1248

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/536-54-0x0000000001000000-0x000000000101A000-memory.dmp

Filesize
104KB

Download
memory/536-55-0x0000000001000000-0x000000000101A000-memory.dmp

Filesize
104KB

Download