939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9

Analysis

max time kernel
37s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe
Size

56KB
MD5

0c37a53be0c8191bf868c0e570b65b40
SHA1

99817e99c9777c2f30e66e887acaa247d8309247
SHA256

939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9
SHA512

054924947288bebf93e72b9200ba803a152a503067b0dc58e27d6f35e8cf938bf6d4d51d6bd9ba3ac9414c14b40d92de53dab72b801f77b7ab367ccd57369bae
SSDEEP

1536:9m2a9ErFQWCrn9p330N2+2UJLojlyVpq12c1U:9W+rFQWCrn9p330xFWyVy2c

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe

Suspicious behavior: MapViewOfSection 21 IoCs

pid	Process
364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe
364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe
364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe
364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe
364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe
364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe
364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe
364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe
364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe
364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe
364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe
364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe
364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe
364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe
364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe
364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe
364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe
364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe
364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe
364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe
364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 368	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	22
PID 364 wrote to memory of 368	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	22
PID 364 wrote to memory of 368	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	22
PID 364 wrote to memory of 368	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	22
PID 364 wrote to memory of 368	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	22
PID 364 wrote to memory of 368	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	22
PID 364 wrote to memory of 368	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	22
PID 364 wrote to memory of 380	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	4
PID 364 wrote to memory of 380	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	4
PID 364 wrote to memory of 380	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	4
PID 364 wrote to memory of 380	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	4
PID 364 wrote to memory of 380	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	4
PID 364 wrote to memory of 380	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	4
PID 364 wrote to memory of 380	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	4
PID 364 wrote to memory of 420	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	3
PID 364 wrote to memory of 420	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	3
PID 364 wrote to memory of 420	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	3
PID 364 wrote to memory of 420	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	3
PID 364 wrote to memory of 420	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	3
PID 364 wrote to memory of 420	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	3
PID 364 wrote to memory of 420	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	3
PID 364 wrote to memory of 468	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	2
PID 364 wrote to memory of 468	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	2
PID 364 wrote to memory of 468	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	2
PID 364 wrote to memory of 468	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	2
PID 364 wrote to memory of 468	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	2
PID 364 wrote to memory of 468	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	2
PID 364 wrote to memory of 468	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	2
PID 364 wrote to memory of 476	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	1
PID 364 wrote to memory of 476	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	1
PID 364 wrote to memory of 476	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	1
PID 364 wrote to memory of 476	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	1
PID 364 wrote to memory of 476	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	1
PID 364 wrote to memory of 476	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	1
PID 364 wrote to memory of 476	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	1
PID 364 wrote to memory of 484	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	21
PID 364 wrote to memory of 484	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	21
PID 364 wrote to memory of 484	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	21
PID 364 wrote to memory of 484	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	21
PID 364 wrote to memory of 484	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	21
PID 364 wrote to memory of 484	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	21
PID 364 wrote to memory of 484	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	21
PID 364 wrote to memory of 584	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	5
PID 364 wrote to memory of 584	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	5
PID 364 wrote to memory of 584	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	5
PID 364 wrote to memory of 584	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	5
PID 364 wrote to memory of 584	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	5
PID 364 wrote to memory of 584	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	5
PID 364 wrote to memory of 584	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	5
PID 364 wrote to memory of 660	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	20
PID 364 wrote to memory of 660	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	20
PID 364 wrote to memory of 660	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	20
PID 364 wrote to memory of 660	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	20
PID 364 wrote to memory of 660	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	20
PID 364 wrote to memory of 660	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	20
PID 364 wrote to memory of 660	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	20
PID 364 wrote to memory of 740	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	19
PID 364 wrote to memory of 740	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	19
PID 364 wrote to memory of 740	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	19
PID 364 wrote to memory of 740	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	19
PID 364 wrote to memory of 740	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	19
PID 364 wrote to memory of 740	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	19
PID 364 wrote to memory of 740	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	19
PID 364 wrote to memory of 804	364	939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe	18

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:476

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:468
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:584
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:292
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:1792
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1240
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:752
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1036
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:284
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:868
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:844
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:804
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:740
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:660

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:380
- C:\Windows\system32\conhost.exe
  \??\C:\Windows\system32\conhost.exe "104023927136570299919172501061910430442-1381025287-1952036318-18197740251938545325"
  2⤵
  PID:1620

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1356
- C:\Users\Admin\AppData\Local\Temp\939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe
  "C:\Users\Admin\AppData\Local\Temp\939fe9b3dfc6f1591aa2fd5940374823583762ccfe1beee43fb6fab2eca88fc9.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:364

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1320

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:484

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/364-54-0x0000000001000000-0x0000000001014000-memory.dmp

Filesize
80KB

Download