Overview

overview

10

Static

static

1c991ad9e6...b9.exe

windows7-x64

1

1c991ad9e6...b9.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    4s
  • max time network
    31s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    26-11-2022 15:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1c991ad9e6a09ebde65d749f78a4a73890bf26780891410ca8a07b1dab841ab9.exe

  • Size

    1.0MB

  • MD5

    acd430684ecc9c6278874183ca40a133

  • SHA1

    b7fa9d0383a64e5a3c18a66fa3ef4d349d60fbb2

  • SHA256

    1c991ad9e6a09ebde65d749f78a4a73890bf26780891410ca8a07b1dab841ab9

  • SHA512

    301ab23e0989cdd42418d1a5f215ced23a54437d15d8fb6adbaf25edebdbca5ead5ce30a19b5eddba7c63ed07007d946050b830d6c293384d096de718b5c6d8c

  • SSDEEP

    12288:Xu460DZby5vzCrdIxM0VVaCWg5ctGnw1uia4goH71NvQZoXYE/WRs4haBVtL8skS:e460EzVMoaXgFw0ia4goHRos4olL8VO

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1c991ad9e6a09ebde65d749f78a4a73890bf26780891410ca8a07b1dab841ab9.exe
    "C:\Users\Admin\AppData\Local\Temp\1c991ad9e6a09ebde65d749f78a4a73890bf26780891410ca8a07b1dab841ab9.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:832
    • C:\Users\Admin\AppData\Local\Temp\1c991ad9e6a09ebde65d749f78a4a73890bf26780891410ca8a07b1dab841ab9.exe
      "C:\Users\Admin\AppData\Local\Temp\1c991ad9e6a09ebde65d749f78a4a73890bf26780891410ca8a07b1dab841ab9.exe"
      2⤵
        PID:1480
      • C:\Users\Admin\AppData\Local\Temp\1c991ad9e6a09ebde65d749f78a4a73890bf26780891410ca8a07b1dab841ab9.exe
        "C:\Users\Admin\AppData\Local\Temp\1c991ad9e6a09ebde65d749f78a4a73890bf26780891410ca8a07b1dab841ab9.exe"
        2⤵
          PID:1496
        • C:\Users\Admin\AppData\Local\Temp\1c991ad9e6a09ebde65d749f78a4a73890bf26780891410ca8a07b1dab841ab9.exe
          "C:\Users\Admin\AppData\Local\Temp\1c991ad9e6a09ebde65d749f78a4a73890bf26780891410ca8a07b1dab841ab9.exe"
          2⤵
            PID:1736
          • C:\Users\Admin\AppData\Local\Temp\1c991ad9e6a09ebde65d749f78a4a73890bf26780891410ca8a07b1dab841ab9.exe
            "C:\Users\Admin\AppData\Local\Temp\1c991ad9e6a09ebde65d749f78a4a73890bf26780891410ca8a07b1dab841ab9.exe"
            2⤵
              PID:1760
            • C:\Users\Admin\AppData\Local\Temp\1c991ad9e6a09ebde65d749f78a4a73890bf26780891410ca8a07b1dab841ab9.exe
              "C:\Users\Admin\AppData\Local\Temp\1c991ad9e6a09ebde65d749f78a4a73890bf26780891410ca8a07b1dab841ab9.exe"
              2⤵
                PID:860

            Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/832-54-0x0000000075291000-0x0000000075293000-memory.dmp
              Filesize

              8KB

              Download
            • memory/832-55-0x0000000074100000-0x00000000746AB000-memory.dmp
              Filesize

              5.7MB

              Download
            • memory/832-56-0x0000000074100000-0x00000000746AB000-memory.dmp
              Filesize

              5.7MB

              Download