ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988

Analysis

max time kernel
46s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 22:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe
Size

50KB
MD5

0de7461bb7a737be41fdb2a526c716d0
SHA1

bd11b08a0582a77d359ef4448fe00a23b4534428
SHA256

ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988
SHA512

ebdfedc31f5936987d4b37885f8b8bbd53ce2b203db00cddc6d5d5a5c3fe4a3ed4b63053b669d0daa5964a367b15238124eab303b738e75a54630506f20eb213
SSDEEP

768:5+o+V1TtXSHf+AM+7/Nvdki8TLEZDGd12YM5kjhHq5GhSM6y:59+V1TtiHf3MIWTIGM4V6wSA

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe

Suspicious behavior: MapViewOfSection 22 IoCs

pid	Process
1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe
1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe
1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe
1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe
1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe
1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe
1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe
1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe
1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe
1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe
1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe
1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe
1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe
1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe
1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe
1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe
1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe
1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe
1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe
1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe
1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe
1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 372	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	23
PID 1204 wrote to memory of 372	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	23
PID 1204 wrote to memory of 372	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	23
PID 1204 wrote to memory of 372	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	23
PID 1204 wrote to memory of 372	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	23
PID 1204 wrote to memory of 372	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	23
PID 1204 wrote to memory of 372	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	23
PID 1204 wrote to memory of 384	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	22
PID 1204 wrote to memory of 384	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	22
PID 1204 wrote to memory of 384	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	22
PID 1204 wrote to memory of 384	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	22
PID 1204 wrote to memory of 384	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	22
PID 1204 wrote to memory of 384	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	22
PID 1204 wrote to memory of 384	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	22
PID 1204 wrote to memory of 420	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	3
PID 1204 wrote to memory of 420	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	3
PID 1204 wrote to memory of 420	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	3
PID 1204 wrote to memory of 420	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	3
PID 1204 wrote to memory of 420	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	3
PID 1204 wrote to memory of 420	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	3
PID 1204 wrote to memory of 420	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	3
PID 1204 wrote to memory of 468	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	2
PID 1204 wrote to memory of 468	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	2
PID 1204 wrote to memory of 468	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	2
PID 1204 wrote to memory of 468	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	2
PID 1204 wrote to memory of 468	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	2
PID 1204 wrote to memory of 468	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	2
PID 1204 wrote to memory of 468	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	2
PID 1204 wrote to memory of 484	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	1
PID 1204 wrote to memory of 484	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	1
PID 1204 wrote to memory of 484	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	1
PID 1204 wrote to memory of 484	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	1
PID 1204 wrote to memory of 484	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	1
PID 1204 wrote to memory of 484	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	1
PID 1204 wrote to memory of 484	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	1
PID 1204 wrote to memory of 492	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	21
PID 1204 wrote to memory of 492	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	21
PID 1204 wrote to memory of 492	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	21
PID 1204 wrote to memory of 492	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	21
PID 1204 wrote to memory of 492	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	21
PID 1204 wrote to memory of 492	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	21
PID 1204 wrote to memory of 492	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	21
PID 1204 wrote to memory of 600	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	20
PID 1204 wrote to memory of 600	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	20
PID 1204 wrote to memory of 600	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	20
PID 1204 wrote to memory of 600	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	20
PID 1204 wrote to memory of 600	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	20
PID 1204 wrote to memory of 600	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	20
PID 1204 wrote to memory of 600	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	20
PID 1204 wrote to memory of 680	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	19
PID 1204 wrote to memory of 680	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	19
PID 1204 wrote to memory of 680	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	19
PID 1204 wrote to memory of 680	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	19
PID 1204 wrote to memory of 680	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	19
PID 1204 wrote to memory of 680	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	19
PID 1204 wrote to memory of 680	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	19
PID 1204 wrote to memory of 748	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	4
PID 1204 wrote to memory of 748	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	4
PID 1204 wrote to memory of 748	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	4
PID 1204 wrote to memory of 748	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	4
PID 1204 wrote to memory of 748	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	4
PID 1204 wrote to memory of 748	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	4
PID 1204 wrote to memory of 748	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	4
PID 1204 wrote to memory of 816	1204	ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe	18

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:484

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:468
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:748
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1152
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:768
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:864
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1068
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:296
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:324
- - C:\Windows\system32\wininit.exe
    wininit.exe
    3⤵
    PID:372
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:884
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:852
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:816
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:680
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:600

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:1904

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1288
- C:\Users\Admin\AppData\Local\Temp\ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe
  "C:\Users\Admin\AppData\Local\Temp\ee880e8f04704788b31a0f9dfaa2b2f1cafe96af512866f12ac3eeb2e2cd5988.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1204

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1232

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:492

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:384
- C:\Windows\system32\conhost.exe
  \??\C:\Windows\system32\conhost.exe "-335167255-1342402528-1868656947-2094999680-4050514531668939691024914154953546764"
  2⤵
  PID:1252

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1204-54-0x0000000001000000-0x0000000001010000-memory.dmp

Filesize
64KB

Download