ac4c422f2b4d75c0cb8a8522d082118f31cb35ee17996624d16ae46e98d811ac

Analysis

max time kernel
3s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23/11/2022, 23:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac4c422f2b4d75c0cb8a8522d082118f31cb35ee17996624d16ae46e98d811ac.exe
Size

167KB
MD5

40d4e7a524fd729431a6602da1d00220
SHA1

db21bdda35a47dd35af84328af8c53b888548f51
SHA256

ac4c422f2b4d75c0cb8a8522d082118f31cb35ee17996624d16ae46e98d811ac
SHA512

eab3bd09b23711defdb513a4e7ace4acff6a9869a89ca3e92994907732eb8a1d057760e809e0d46a86c9884bfe531205e16f4a139604fa725b85a5a720ecb326
SSDEEP

3072:dL1XmHqqI8+oRQxvP/iGK1frztO2RbpLmJGU67qWBHgEujXC8LcE:nXmXIrxvP/i9rY0pLm07qWBHgzzcE

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2020 set thread context of 2008	2020	ac4c422f2b4d75c0cb8a8522d082118f31cb35ee17996624d16ae46e98d811ac.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2008	ac4c422f2b4d75c0cb8a8522d082118f31cb35ee17996624d16ae46e98d811ac.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2020	ac4c422f2b4d75c0cb8a8522d082118f31cb35ee17996624d16ae46e98d811ac.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2008	2020	ac4c422f2b4d75c0cb8a8522d082118f31cb35ee17996624d16ae46e98d811ac.exe	27
PID 2020 wrote to memory of 2008	2020	ac4c422f2b4d75c0cb8a8522d082118f31cb35ee17996624d16ae46e98d811ac.exe	27
PID 2020 wrote to memory of 2008	2020	ac4c422f2b4d75c0cb8a8522d082118f31cb35ee17996624d16ae46e98d811ac.exe	27
PID 2020 wrote to memory of 2008	2020	ac4c422f2b4d75c0cb8a8522d082118f31cb35ee17996624d16ae46e98d811ac.exe	27
PID 2020 wrote to memory of 2008	2020	ac4c422f2b4d75c0cb8a8522d082118f31cb35ee17996624d16ae46e98d811ac.exe	27
PID 2020 wrote to memory of 2008	2020	ac4c422f2b4d75c0cb8a8522d082118f31cb35ee17996624d16ae46e98d811ac.exe	27
PID 2020 wrote to memory of 2008	2020	ac4c422f2b4d75c0cb8a8522d082118f31cb35ee17996624d16ae46e98d811ac.exe	27
PID 2020 wrote to memory of 2008	2020	ac4c422f2b4d75c0cb8a8522d082118f31cb35ee17996624d16ae46e98d811ac.exe	27
PID 2020 wrote to memory of 2008	2020	ac4c422f2b4d75c0cb8a8522d082118f31cb35ee17996624d16ae46e98d811ac.exe	27
PID 2008 wrote to memory of 1372	2008	ac4c422f2b4d75c0cb8a8522d082118f31cb35ee17996624d16ae46e98d811ac.exe	15
PID 2008 wrote to memory of 1372	2008	ac4c422f2b4d75c0cb8a8522d082118f31cb35ee17996624d16ae46e98d811ac.exe	15
PID 2008 wrote to memory of 1372	2008	ac4c422f2b4d75c0cb8a8522d082118f31cb35ee17996624d16ae46e98d811ac.exe	15
PID 2008 wrote to memory of 1372	2008	ac4c422f2b4d75c0cb8a8522d082118f31cb35ee17996624d16ae46e98d811ac.exe	15
PID 2008 wrote to memory of 1372	2008	ac4c422f2b4d75c0cb8a8522d082118f31cb35ee17996624d16ae46e98d811ac.exe	15

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1372
- C:\Users\Admin\AppData\Local\Temp\ac4c422f2b4d75c0cb8a8522d082118f31cb35ee17996624d16ae46e98d811ac.exe
  "C:\Users\Admin\AppData\Local\Temp\ac4c422f2b4d75c0cb8a8522d082118f31cb35ee17996624d16ae46e98d811ac.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Users\Admin\AppData\Local\Temp\ac4c422f2b4d75c0cb8a8522d082118f31cb35ee17996624d16ae46e98d811ac.exe
    "C:\Users\Admin\AppData\Local\Temp\ac4c422f2b4d75c0cb8a8522d082118f31cb35ee17996624d16ae46e98d811ac.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2008-55-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2008-56-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2008-58-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2008-67-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2008-64-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2008-61-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2020-54-0x0000000076691000-0x0000000076693000-memory.dmp

Filesize
8KB

Download
memory/2020-68-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download