b8530172c75b4bc015af84448161265cd56b48c8d92e97e623ab5bf0fdcd3fe3

Analysis

max time kernel
46s
max time network
97s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 10:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b8530172c75b4bc015af84448161265cd56b48c8d92e97e623ab5bf0fdcd3fe3.exe
Size

135KB
MD5

a22e749e93e700349342efb123affe50
SHA1

2582ab409a295e10e1b54462a46fdc61a9b5beaa
SHA256

b8530172c75b4bc015af84448161265cd56b48c8d92e97e623ab5bf0fdcd3fe3
SHA512

bce75b7e7022f7ba8434f2f61f4cd23a94b2e24fa318c8b3696ee67d2c91ecdfa116071437f5b274b65bf28bb47e410080556f176d1bbab71ed150add56a35b3
SSDEEP

3072:jmA6SzGc9rRUi9zcjBf020BaSwr2mrm6ks+gO6r682:6AFzGc9rRUgzc9fz0Bp2DmJNghmb

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1324	b8530172c75b4bc015af84448161265cd56b48c8d92e97e623ab5bf0fdcd3fe3.exe
1324	b8530172c75b4bc015af84448161265cd56b48c8d92e97e623ab5bf0fdcd3fe3.exe
1324	b8530172c75b4bc015af84448161265cd56b48c8d92e97e623ab5bf0fdcd3fe3.exe
1324	b8530172c75b4bc015af84448161265cd56b48c8d92e97e623ab5bf0fdcd3fe3.exe
1324	b8530172c75b4bc015af84448161265cd56b48c8d92e97e623ab5bf0fdcd3fe3.exe
1324	b8530172c75b4bc015af84448161265cd56b48c8d92e97e623ab5bf0fdcd3fe3.exe
1324	b8530172c75b4bc015af84448161265cd56b48c8d92e97e623ab5bf0fdcd3fe3.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1324	b8530172c75b4bc015af84448161265cd56b48c8d92e97e623ab5bf0fdcd3fe3.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 468	1324	b8530172c75b4bc015af84448161265cd56b48c8d92e97e623ab5bf0fdcd3fe3.exe	27
PID 1324 wrote to memory of 468	1324	b8530172c75b4bc015af84448161265cd56b48c8d92e97e623ab5bf0fdcd3fe3.exe	27
PID 1324 wrote to memory of 468	1324	b8530172c75b4bc015af84448161265cd56b48c8d92e97e623ab5bf0fdcd3fe3.exe	27
PID 1324 wrote to memory of 468	1324	b8530172c75b4bc015af84448161265cd56b48c8d92e97e623ab5bf0fdcd3fe3.exe	27
PID 1324 wrote to memory of 280	1324	b8530172c75b4bc015af84448161265cd56b48c8d92e97e623ab5bf0fdcd3fe3.exe	29
PID 1324 wrote to memory of 280	1324	b8530172c75b4bc015af84448161265cd56b48c8d92e97e623ab5bf0fdcd3fe3.exe	29
PID 1324 wrote to memory of 280	1324	b8530172c75b4bc015af84448161265cd56b48c8d92e97e623ab5bf0fdcd3fe3.exe	29
PID 1324 wrote to memory of 280	1324	b8530172c75b4bc015af84448161265cd56b48c8d92e97e623ab5bf0fdcd3fe3.exe	29
PID 1324 wrote to memory of 452	1324	b8530172c75b4bc015af84448161265cd56b48c8d92e97e623ab5bf0fdcd3fe3.exe	31
PID 1324 wrote to memory of 452	1324	b8530172c75b4bc015af84448161265cd56b48c8d92e97e623ab5bf0fdcd3fe3.exe	31
PID 1324 wrote to memory of 452	1324	b8530172c75b4bc015af84448161265cd56b48c8d92e97e623ab5bf0fdcd3fe3.exe	31
PID 1324 wrote to memory of 452	1324	b8530172c75b4bc015af84448161265cd56b48c8d92e97e623ab5bf0fdcd3fe3.exe	31
PID 1324 wrote to memory of 1312	1324	b8530172c75b4bc015af84448161265cd56b48c8d92e97e623ab5bf0fdcd3fe3.exe	32
PID 1324 wrote to memory of 1312	1324	b8530172c75b4bc015af84448161265cd56b48c8d92e97e623ab5bf0fdcd3fe3.exe	32
PID 1324 wrote to memory of 1312	1324	b8530172c75b4bc015af84448161265cd56b48c8d92e97e623ab5bf0fdcd3fe3.exe	32
PID 1324 wrote to memory of 1312	1324	b8530172c75b4bc015af84448161265cd56b48c8d92e97e623ab5bf0fdcd3fe3.exe	32
PID 1324 wrote to memory of 1752	1324	b8530172c75b4bc015af84448161265cd56b48c8d92e97e623ab5bf0fdcd3fe3.exe	33
PID 1324 wrote to memory of 1752	1324	b8530172c75b4bc015af84448161265cd56b48c8d92e97e623ab5bf0fdcd3fe3.exe	33
PID 1324 wrote to memory of 1752	1324	b8530172c75b4bc015af84448161265cd56b48c8d92e97e623ab5bf0fdcd3fe3.exe	33
PID 1324 wrote to memory of 1752	1324	b8530172c75b4bc015af84448161265cd56b48c8d92e97e623ab5bf0fdcd3fe3.exe	33
PID 1324 wrote to memory of 1732	1324	b8530172c75b4bc015af84448161265cd56b48c8d92e97e623ab5bf0fdcd3fe3.exe	34
PID 1324 wrote to memory of 1732	1324	b8530172c75b4bc015af84448161265cd56b48c8d92e97e623ab5bf0fdcd3fe3.exe	34
PID 1324 wrote to memory of 1732	1324	b8530172c75b4bc015af84448161265cd56b48c8d92e97e623ab5bf0fdcd3fe3.exe	34
PID 1324 wrote to memory of 1732	1324	b8530172c75b4bc015af84448161265cd56b48c8d92e97e623ab5bf0fdcd3fe3.exe	34
PID 1324 wrote to memory of 1520	1324	b8530172c75b4bc015af84448161265cd56b48c8d92e97e623ab5bf0fdcd3fe3.exe	35
PID 1324 wrote to memory of 1520	1324	b8530172c75b4bc015af84448161265cd56b48c8d92e97e623ab5bf0fdcd3fe3.exe	35
PID 1324 wrote to memory of 1520	1324	b8530172c75b4bc015af84448161265cd56b48c8d92e97e623ab5bf0fdcd3fe3.exe	35
PID 1324 wrote to memory of 1520	1324	b8530172c75b4bc015af84448161265cd56b48c8d92e97e623ab5bf0fdcd3fe3.exe	35
PID 1324 wrote to memory of 1596	1324	b8530172c75b4bc015af84448161265cd56b48c8d92e97e623ab5bf0fdcd3fe3.exe	36
PID 1324 wrote to memory of 1596	1324	b8530172c75b4bc015af84448161265cd56b48c8d92e97e623ab5bf0fdcd3fe3.exe	36
PID 1324 wrote to memory of 1596	1324	b8530172c75b4bc015af84448161265cd56b48c8d92e97e623ab5bf0fdcd3fe3.exe	36
PID 1324 wrote to memory of 1596	1324	b8530172c75b4bc015af84448161265cd56b48c8d92e97e623ab5bf0fdcd3fe3.exe	36

C:\Users\Admin\AppData\Local\Temp\b8530172c75b4bc015af84448161265cd56b48c8d92e97e623ab5bf0fdcd3fe3.exe
"C:\Users\Admin\AppData\Local\Temp\b8530172c75b4bc015af84448161265cd56b48c8d92e97e623ab5bf0fdcd3fe3.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\SysWOW64\CMD.exe
  "CMD"
  2⤵
  PID:468
- C:\Windows\SysWOW64\CMD.exe
  "CMD"
  2⤵
  PID:280
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:452
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:1312
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:1752
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:1732
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:1520
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:1596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1324-54-0x00000000752B1000-0x00000000752B3000-memory.dmp

Filesize
8KB

Download
memory/1324-55-0x0000000074100000-0x00000000746AB000-memory.dmp

Filesize
5.7MB

Download
memory/1324-58-0x0000000074100000-0x00000000746AB000-memory.dmp

Filesize
5.7MB

Download