Analysis
-
max time kernel
42s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
25-11-2022 06:59
General
-
Target
d616feeb1c8b5387ad49eae70285cfc7a252607ad2efb2019dc804df3fca9bfe.exe
-
Size
28KB
-
MD5
ac5b960528ef687e6bf07ab486b2ff79
-
SHA1
ec31f24c21d4f6ea968788ebf0c63d0c17379c12
-
SHA256
d616feeb1c8b5387ad49eae70285cfc7a252607ad2efb2019dc804df3fca9bfe
-
SHA512
42c6d91a29de87f1ef788a236af6952654926cfdfdb408dfcc9c780704682b0ac387740195a48b3e42cbc8622fd61026aeeccc93b446410aa195029343c67c9a
-
SSDEEP
384:ueqtEesJaxsvQd035njBNw3Ml/oIXqgbilXLQ8AJMJfd7abZofCG/rEHzSHoj:grW35jBNw3MlTXpilXLQhJMXaduUzJ
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d616feeb1c8b5387ad49eae70285cfc7a252607ad2efb2019dc804df3fca9bfe.exe"C:\Users\Admin\AppData\Local\Temp\d616feeb1c8b5387ad49eae70285cfc7a252607ad2efb2019dc804df3fca9bfe.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\svchost.exe"C:\Windows\syswow64\svchost.exe"2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/328-56-0x0000000000000000-mapping.dmp
-
memory/328-58-0x00000000001A0000-0x00000000001A8000-memory.dmpFilesize
32KB
-
memory/328-59-0x0000000000080000-0x0000000000083000-memory.dmpFilesize
12KB
-
memory/1504-54-0x0000000075ED1000-0x0000000075ED3000-memory.dmpFilesize
8KB
-
memory/1504-55-0x00000000001B0000-0x00000000001B3000-memory.dmpFilesize
12KB