ad685db8c0a4dab90ebbd009ad5df9208b1ad93ea8d9773f30542cc7e64377bb

Analysis

max time kernel
46s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
17/11/2022, 08:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
10ed3b9ed303c5cafc3d200379a059a5.exe
Size 522KB
Sample221117-j8fdmaea25
SHA256 ad685db8c0a4dab90ebbd009ad5df9208b1ad93ea8d9773f30542cc7e64377bb
MD5 10ed3b9ed303c5cafc3d200379a059a5
SHA1 e71ce18697a24c9e69c6e9d8329ee8df7a6e6d2c
SHA512 02972732897101f04bcd02531579eb3165f6164c239c1b7aac5bb9cb372846c5a07db341235bdb26ee58bfb40e1c4d465f54a9351528454e20bd68b81634e326
SSDEEP 12288:IWpDlyuGAkMs/FqfJNpVmUji6YufSisMtEEBxa5z0L:I4hyuyP/FUVmtiZOEBxs
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1564	10ed3b9ed303c5cafc3d200379a059a5.exe
1564	10ed3b9ed303c5cafc3d200379a059a5.exe
1564	10ed3b9ed303c5cafc3d200379a059a5.exe
1564	10ed3b9ed303c5cafc3d200379a059a5.exe
1564	10ed3b9ed303c5cafc3d200379a059a5.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1564	10ed3b9ed303c5cafc3d200379a059a5.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 1064	1564	10ed3b9ed303c5cafc3d200379a059a5.exe	28
PID 1564 wrote to memory of 1064	1564	10ed3b9ed303c5cafc3d200379a059a5.exe	28
PID 1564 wrote to memory of 1064	1564	10ed3b9ed303c5cafc3d200379a059a5.exe	28
PID 1564 wrote to memory of 1064	1564	10ed3b9ed303c5cafc3d200379a059a5.exe	28
PID 1564 wrote to memory of 1068	1564	10ed3b9ed303c5cafc3d200379a059a5.exe	29
PID 1564 wrote to memory of 1068	1564	10ed3b9ed303c5cafc3d200379a059a5.exe	29
PID 1564 wrote to memory of 1068	1564	10ed3b9ed303c5cafc3d200379a059a5.exe	29
PID 1564 wrote to memory of 1068	1564	10ed3b9ed303c5cafc3d200379a059a5.exe	29
PID 1564 wrote to memory of 1508	1564	10ed3b9ed303c5cafc3d200379a059a5.exe	30
PID 1564 wrote to memory of 1508	1564	10ed3b9ed303c5cafc3d200379a059a5.exe	30
PID 1564 wrote to memory of 1508	1564	10ed3b9ed303c5cafc3d200379a059a5.exe	30
PID 1564 wrote to memory of 1508	1564	10ed3b9ed303c5cafc3d200379a059a5.exe	30
PID 1564 wrote to memory of 1660	1564	10ed3b9ed303c5cafc3d200379a059a5.exe	31
PID 1564 wrote to memory of 1660	1564	10ed3b9ed303c5cafc3d200379a059a5.exe	31
PID 1564 wrote to memory of 1660	1564	10ed3b9ed303c5cafc3d200379a059a5.exe	31
PID 1564 wrote to memory of 1660	1564	10ed3b9ed303c5cafc3d200379a059a5.exe	31
PID 1564 wrote to memory of 520	1564	10ed3b9ed303c5cafc3d200379a059a5.exe	32
PID 1564 wrote to memory of 520	1564	10ed3b9ed303c5cafc3d200379a059a5.exe	32
PID 1564 wrote to memory of 520	1564	10ed3b9ed303c5cafc3d200379a059a5.exe	32
PID 1564 wrote to memory of 520	1564	10ed3b9ed303c5cafc3d200379a059a5.exe	32

C:\Users\Admin\AppData\Local\Temp\10ed3b9ed303c5cafc3d200379a059a5.exe
"C:\Users\Admin\AppData\Local\Temp\10ed3b9ed303c5cafc3d200379a059a5.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Users\Admin\AppData\Local\Temp\10ed3b9ed303c5cafc3d200379a059a5.exe
  "C:\Users\Admin\AppData\Local\Temp\10ed3b9ed303c5cafc3d200379a059a5.exe"
  2⤵
  PID:1064
- C:\Users\Admin\AppData\Local\Temp\10ed3b9ed303c5cafc3d200379a059a5.exe
  "C:\Users\Admin\AppData\Local\Temp\10ed3b9ed303c5cafc3d200379a059a5.exe"
  2⤵
  PID:1068
- C:\Users\Admin\AppData\Local\Temp\10ed3b9ed303c5cafc3d200379a059a5.exe
  "C:\Users\Admin\AppData\Local\Temp\10ed3b9ed303c5cafc3d200379a059a5.exe"
  2⤵
  PID:1508
- C:\Users\Admin\AppData\Local\Temp\10ed3b9ed303c5cafc3d200379a059a5.exe
  "C:\Users\Admin\AppData\Local\Temp\10ed3b9ed303c5cafc3d200379a059a5.exe"
  2⤵
  PID:1660
- C:\Users\Admin\AppData\Local\Temp\10ed3b9ed303c5cafc3d200379a059a5.exe
  "C:\Users\Admin\AppData\Local\Temp\10ed3b9ed303c5cafc3d200379a059a5.exe"
  2⤵
  PID:520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1564-54-0x0000000000390000-0x0000000000418000-memory.dmp

Download

memory/1564-55-0x00000000766F1000-0x00000000766F3000-memory.dmp

Download

memory/1564-56-0x00000000020C0000-0x0000000002150000-memory.dmp

Download

memory/1564-57-0x0000000000560000-0x0000000000578000-memory.dmp

Download

memory/1564-58-0x0000000000540000-0x000000000054C000-memory.dmp

Download

memory/1564-59-0x00000000042B0000-0x0000000004310000-memory.dmp

Download

memory/1564-60-0x0000000001F30000-0x0000000001F56000-memory.dmp

Download