2d3030fd5b7664be15fc730d2e6ecaf0a0df5a28ee2aad28cd6b989b64c8e262

Analysis

max time kernel
59s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 03:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86e8bfaeaff4ba2706de162b159d6052.exe
Size

1.1MB
MD5

86e8bfaeaff4ba2706de162b159d6052
SHA1

28b240580810cf142440558c073118f5a7cb6cc1
SHA256

2d3030fd5b7664be15fc730d2e6ecaf0a0df5a28ee2aad28cd6b989b64c8e262
SHA512

40e3a05a63efb06bb8628f03be726ff18055bf9cfe44b35f6c95bd69816c11c0ace421dbbc3ccf57159edc78ae9f7173391815fde7b20d333a53162076e3f2e3
SSDEEP

24576:YAFBkPPpLnSrpcMiU7e0zJO4w1Uk3PeLAwhrbhP:vFyhnypZtJ5w1XYhhf

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

86e8bfaeaff4ba2706de162b159d6052.exe

pid	process
772	86e8bfaeaff4ba2706de162b159d6052.exe
772	86e8bfaeaff4ba2706de162b159d6052.exe
772	86e8bfaeaff4ba2706de162b159d6052.exe
772	86e8bfaeaff4ba2706de162b159d6052.exe
772	86e8bfaeaff4ba2706de162b159d6052.exe
772	86e8bfaeaff4ba2706de162b159d6052.exe
772	86e8bfaeaff4ba2706de162b159d6052.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

86e8bfaeaff4ba2706de162b159d6052.exe

description pid process

Token: SeDebugPrivilege 772 86e8bfaeaff4ba2706de162b159d6052.exe

description	pid	process
Token: SeDebugPrivilege	772	86e8bfaeaff4ba2706de162b159d6052.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

86e8bfaeaff4ba2706de162b159d6052.exe

C:\Users\Admin\AppData\Local\Temp\86e8bfaeaff4ba2706de162b159d6052.exe
"C:\Users\Admin\AppData\Local\Temp\86e8bfaeaff4ba2706de162b159d6052.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:772

C:\Users\Admin\AppData\Local\Temp\86e8bfaeaff4ba2706de162b159d6052.exe
"C:\Users\Admin\AppData\Local\Temp\86e8bfaeaff4ba2706de162b159d6052.exe"
2⤵
PID:1304

C:\Users\Admin\AppData\Local\Temp\86e8bfaeaff4ba2706de162b159d6052.exe
"C:\Users\Admin\AppData\Local\Temp\86e8bfaeaff4ba2706de162b159d6052.exe"
2⤵
PID:1688

C:\Users\Admin\AppData\Local\Temp\86e8bfaeaff4ba2706de162b159d6052.exe
"C:\Users\Admin\AppData\Local\Temp\86e8bfaeaff4ba2706de162b159d6052.exe"
2⤵
PID:1704

C:\Users\Admin\AppData\Local\Temp\86e8bfaeaff4ba2706de162b159d6052.exe
"C:\Users\Admin\AppData\Local\Temp\86e8bfaeaff4ba2706de162b159d6052.exe"
2⤵
PID:1864

C:\Users\Admin\AppData\Local\Temp\86e8bfaeaff4ba2706de162b159d6052.exe
"C:\Users\Admin\AppData\Local\Temp\86e8bfaeaff4ba2706de162b159d6052.exe"
2⤵
PID:1772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/772-54-0x0000000000340000-0x0000000000456000-memory.dmp

Filesize
1.1MB

Download
memory/772-55-0x0000000076B51000-0x0000000076B53000-memory.dmp

Filesize
8KB

Download
memory/772-56-0x00000000006F0000-0x0000000000706000-memory.dmp

Filesize
88KB

Download
memory/772-57-0x0000000008790000-0x0000000008862000-memory.dmp

Filesize
840KB

Download
memory/772-58-0x0000000004B00000-0x0000000004B7C000-memory.dmp

Filesize
496KB

Download

description	pid	process	target process
PID 772 wrote to memory of 1304	772	86e8bfaeaff4ba2706de162b159d6052.exe	86e8bfaeaff4ba2706de162b159d6052.exe
PID 772 wrote to memory of 1304	772	86e8bfaeaff4ba2706de162b159d6052.exe	86e8bfaeaff4ba2706de162b159d6052.exe
PID 772 wrote to memory of 1304	772	86e8bfaeaff4ba2706de162b159d6052.exe	86e8bfaeaff4ba2706de162b159d6052.exe
PID 772 wrote to memory of 1304	772	86e8bfaeaff4ba2706de162b159d6052.exe	86e8bfaeaff4ba2706de162b159d6052.exe
PID 772 wrote to memory of 1688	772	86e8bfaeaff4ba2706de162b159d6052.exe	86e8bfaeaff4ba2706de162b159d6052.exe
PID 772 wrote to memory of 1688	772	86e8bfaeaff4ba2706de162b159d6052.exe	86e8bfaeaff4ba2706de162b159d6052.exe
PID 772 wrote to memory of 1688	772	86e8bfaeaff4ba2706de162b159d6052.exe	86e8bfaeaff4ba2706de162b159d6052.exe
PID 772 wrote to memory of 1688	772	86e8bfaeaff4ba2706de162b159d6052.exe	86e8bfaeaff4ba2706de162b159d6052.exe
PID 772 wrote to memory of 1704	772	86e8bfaeaff4ba2706de162b159d6052.exe	86e8bfaeaff4ba2706de162b159d6052.exe
PID 772 wrote to memory of 1704	772	86e8bfaeaff4ba2706de162b159d6052.exe	86e8bfaeaff4ba2706de162b159d6052.exe
PID 772 wrote to memory of 1704	772	86e8bfaeaff4ba2706de162b159d6052.exe	86e8bfaeaff4ba2706de162b159d6052.exe
PID 772 wrote to memory of 1704	772	86e8bfaeaff4ba2706de162b159d6052.exe	86e8bfaeaff4ba2706de162b159d6052.exe
PID 772 wrote to memory of 1864	772	86e8bfaeaff4ba2706de162b159d6052.exe	86e8bfaeaff4ba2706de162b159d6052.exe
PID 772 wrote to memory of 1864	772	86e8bfaeaff4ba2706de162b159d6052.exe	86e8bfaeaff4ba2706de162b159d6052.exe
PID 772 wrote to memory of 1864	772	86e8bfaeaff4ba2706de162b159d6052.exe	86e8bfaeaff4ba2706de162b159d6052.exe
PID 772 wrote to memory of 1864	772	86e8bfaeaff4ba2706de162b159d6052.exe	86e8bfaeaff4ba2706de162b159d6052.exe
PID 772 wrote to memory of 1772	772	86e8bfaeaff4ba2706de162b159d6052.exe	86e8bfaeaff4ba2706de162b159d6052.exe
PID 772 wrote to memory of 1772	772	86e8bfaeaff4ba2706de162b159d6052.exe	86e8bfaeaff4ba2706de162b159d6052.exe
PID 772 wrote to memory of 1772	772	86e8bfaeaff4ba2706de162b159d6052.exe	86e8bfaeaff4ba2706de162b159d6052.exe
PID 772 wrote to memory of 1772	772	86e8bfaeaff4ba2706de162b159d6052.exe	86e8bfaeaff4ba2706de162b159d6052.exe