52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 17:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe
Size

648KB
MD5

0e1fdc74510968976f9605651e92efe0
SHA1

2117210e2e0b33f8d8181730ef8b9cbcd75c3913
SHA256

52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd
SHA512

48bdb56c0169535be114f360d6f880733b98a60d2cb734a6851e1e3c57cf022bfa15a428d66ca41f97d1e3fb7e5c5952624283acceb49a847a845ba6c74cd860
SSDEEP

6144:o1Jzi0Sw1loH3AdKy9HGeofJgDEvrIslnCUGw/xIRLtxIRLuovZovxlM:6vF1jmN+zaooWi

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe

Suspicious behavior: MapViewOfSection 21 IoCs

pid	Process
740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe
740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe
740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe
740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe
740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe
740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe
740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe
740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe
740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe
740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe
740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe
740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe
740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe
740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe
740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe
740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe
740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe
740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe
740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe
740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe
740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1924	osk.exe
1924	osk.exe
1924	osk.exe
1924	osk.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 372	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	5
PID 740 wrote to memory of 372	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	5
PID 740 wrote to memory of 372	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	5
PID 740 wrote to memory of 372	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	5
PID 740 wrote to memory of 372	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	5
PID 740 wrote to memory of 372	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	5
PID 740 wrote to memory of 384	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	4
PID 740 wrote to memory of 384	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	4
PID 740 wrote to memory of 384	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	4
PID 740 wrote to memory of 384	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	4
PID 740 wrote to memory of 384	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	4
PID 740 wrote to memory of 384	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	4
PID 740 wrote to memory of 420	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	3
PID 740 wrote to memory of 420	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	3
PID 740 wrote to memory of 420	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	3
PID 740 wrote to memory of 420	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	3
PID 740 wrote to memory of 420	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	3
PID 740 wrote to memory of 420	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	3
PID 740 wrote to memory of 464	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	2
PID 740 wrote to memory of 464	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	2
PID 740 wrote to memory of 464	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	2
PID 740 wrote to memory of 464	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	2
PID 740 wrote to memory of 464	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	2
PID 740 wrote to memory of 464	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	2
PID 740 wrote to memory of 480	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	1
PID 740 wrote to memory of 480	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	1
PID 740 wrote to memory of 480	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	1
PID 740 wrote to memory of 480	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	1
PID 740 wrote to memory of 480	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	1
PID 740 wrote to memory of 480	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	1
PID 740 wrote to memory of 488	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	8
PID 740 wrote to memory of 488	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	8
PID 740 wrote to memory of 488	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	8
PID 740 wrote to memory of 488	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	8
PID 740 wrote to memory of 488	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	8
PID 740 wrote to memory of 488	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	8
PID 740 wrote to memory of 584	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	25
PID 740 wrote to memory of 584	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	25
PID 740 wrote to memory of 584	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	25
PID 740 wrote to memory of 584	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	25
PID 740 wrote to memory of 584	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	25
PID 740 wrote to memory of 584	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	25
PID 740 wrote to memory of 660	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	24
PID 740 wrote to memory of 660	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	24
PID 740 wrote to memory of 660	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	24
PID 740 wrote to memory of 660	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	24
PID 740 wrote to memory of 660	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	24
PID 740 wrote to memory of 660	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	24
PID 740 wrote to memory of 716	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	23
PID 740 wrote to memory of 716	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	23
PID 740 wrote to memory of 716	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	23
PID 740 wrote to memory of 716	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	23
PID 740 wrote to memory of 716	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	23
PID 740 wrote to memory of 716	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	23
PID 740 wrote to memory of 792	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	22
PID 740 wrote to memory of 792	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	22
PID 740 wrote to memory of 792	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	22
PID 740 wrote to memory of 792	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	22
PID 740 wrote to memory of 792	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	22
PID 740 wrote to memory of 792	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	22
PID 740 wrote to memory of 828	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	21
PID 740 wrote to memory of 828	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	21
PID 740 wrote to memory of 828	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	21
PID 740 wrote to memory of 828	740	52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe	21

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:480

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:464
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1240
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:1128
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:1780
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1028
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:276
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:296
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:868
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:828
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:792
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:716
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:660
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:584

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420
- C:\Windows\system32\utilman.exe
  utilman.exe /debug
  2⤵
  PID:976
- - C:\Windows\System32\osk.exe
    "C:\Windows\System32\osk.exe"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1924

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:384

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:372
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:488

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:2004

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1392
- C:\Users\Admin\AppData\Local\Temp\52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe
  "C:\Users\Admin\AppData\Local\Temp\52d97d6b9533c715b283dbf42b265bac8e1fa24da2170291f6fd94a21a4191dd.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:740

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/740-54-0x0000000001000000-0x00000000010A6000-memory.dmp

Filesize
664KB

Download
memory/976-55-0x000007FEFB9B1000-0x000007FEFB9B3000-memory.dmp

Filesize
8KB

Download
memory/1924-56-0x0000000000000000-mapping.dmp

Download