Analysis
-
max time kernel
188s -
max time network
191s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23/11/2022, 18:00
Behavioral task
behavioral1
Sample
b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe
Resource
win7-20221111-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe
-
Size
428KB
-
MD5
325d50601d6d6f208310c925bdfaf745
-
SHA1
1373007699efc3be732437dedd9a86b365913fe1
-
SHA256
b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8
-
SHA512
476727638701e9db47ecd84bfdeb84c2aadf83613097b46761739b44efd0c8167fbbe401d0c0ea6743db0a11d61ff22c297e1ff215a2f9b81817e94572fe5d0d
-
SSDEEP
12288:huMwfBi8vvrHxVPKyv2m77sZB07FxObO32Q:hHws8vrx52t07FQaB
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1804-133-0x0000000010410000-0x0000000010480000-memory.dmp upx behavioral2/memory/1804-137-0x0000000010480000-0x00000000104F0000-memory.dmp upx behavioral2/memory/1804-142-0x00000000104F0000-0x0000000010560000-memory.dmp upx behavioral2/memory/1316-145-0x00000000104F0000-0x0000000010560000-memory.dmp upx behavioral2/memory/1316-146-0x00000000104F0000-0x0000000010560000-memory.dmp upx behavioral2/memory/1316-148-0x00000000104F0000-0x0000000010560000-memory.dmp upx -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1316 explorer.exe Token: SeDebugPrivilege 1316 explorer.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82 PID 1804 wrote to memory of 1140 1804 b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe 82
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe"C:\Users\Admin\AppData\Local\Temp\b5dd4a4ef95c5e7fa8223a57f26a4a5ea951982b580b69ae769b94763bdf78b8.exe"2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵PID:1140
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1316
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
385KB
MD57f55d23beeefe6588b24114f1ebacc56
SHA1ecd4494f024697cb163927491a2cbdb5c536bc05
SHA2569224be4fd5f50c74cc666897060603cadc7b2323db90f8e9005b5a4367dc086d
SHA5126ac6c5a66827b8687f1db594c3a34a7c92fcbec98c8f03bf82e80d3a13da2ae919b90c07d3d68a795103c70e7776e9046b6f161c9ec45b1f7e58d3513461f51b