553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 06:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe
Size

95KB
MD5

0cad3d0553648f39890f6f11ff42fd6e
SHA1

347dce5c5655e78b5ed35b17405f3f105cc80363
SHA256

553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750
SHA512

17b92d0035d541ecdc1d770ce65d5df46de10f940e49d2abb41f11e12b4adfdb68f281cb365766ad8107d232d687a98e7646a7723239c21a59c3ca0b2dc6a7d4
SSDEEP

1536:vYTOvy2A4BEQmqbVKmKAiRsqlCiA0RyZoc7TpYQdxjboJI/KmyjTo:vGtpGVKXjRs4A0a93pLdxjEJ+

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1484	lsass.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\sLT.exf	lsass.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\lsass.exe	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe
File opened for modification	C:\Windows\lsass.exe	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe
1484	lsass.exe

Suspicious behavior: MapViewOfSection 45 IoCs

pid	Process
1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe
1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe
1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe
1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe
1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe
1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe
1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe
1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe
1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe
1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe
1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe
1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe
1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe
1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe
1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe
1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe
1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe
1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe
1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe
1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe
1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe
1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe
1484	lsass.exe
1484	lsass.exe
1484	lsass.exe
1484	lsass.exe
1484	lsass.exe
1484	lsass.exe
1484	lsass.exe
1484	lsass.exe
1484	lsass.exe
1484	lsass.exe
1484	lsass.exe
1484	lsass.exe
1484	lsass.exe
1484	lsass.exe
1484	lsass.exe
1484	lsass.exe
1484	lsass.exe
1484	lsass.exe
1484	lsass.exe
1484	lsass.exe
1484	lsass.exe
1484	lsass.exe
1484	lsass.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe
Token: SeDebugPrivilege	1484	lsass.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 372	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	5
PID 1672 wrote to memory of 372	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	5
PID 1672 wrote to memory of 372	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	5
PID 1672 wrote to memory of 372	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	5
PID 1672 wrote to memory of 372	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	5
PID 1672 wrote to memory of 372	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	5
PID 1672 wrote to memory of 372	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	5
PID 1672 wrote to memory of 384	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	4
PID 1672 wrote to memory of 384	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	4
PID 1672 wrote to memory of 384	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	4
PID 1672 wrote to memory of 384	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	4
PID 1672 wrote to memory of 384	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	4
PID 1672 wrote to memory of 384	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	4
PID 1672 wrote to memory of 384	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	4
PID 1672 wrote to memory of 420	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	3
PID 1672 wrote to memory of 420	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	3
PID 1672 wrote to memory of 420	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	3
PID 1672 wrote to memory of 420	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	3
PID 1672 wrote to memory of 420	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	3
PID 1672 wrote to memory of 420	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	3
PID 1672 wrote to memory of 420	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	3
PID 1672 wrote to memory of 464	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	2
PID 1672 wrote to memory of 464	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	2
PID 1672 wrote to memory of 464	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	2
PID 1672 wrote to memory of 464	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	2
PID 1672 wrote to memory of 464	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	2
PID 1672 wrote to memory of 464	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	2
PID 1672 wrote to memory of 464	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	2
PID 1672 wrote to memory of 480	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	1
PID 1672 wrote to memory of 480	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	1
PID 1672 wrote to memory of 480	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	1
PID 1672 wrote to memory of 480	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	1
PID 1672 wrote to memory of 480	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	1
PID 1672 wrote to memory of 480	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	1
PID 1672 wrote to memory of 480	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	1
PID 1672 wrote to memory of 488	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	27
PID 1672 wrote to memory of 488	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	27
PID 1672 wrote to memory of 488	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	27
PID 1672 wrote to memory of 488	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	27
PID 1672 wrote to memory of 488	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	27
PID 1672 wrote to memory of 488	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	27
PID 1672 wrote to memory of 488	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	27
PID 1672 wrote to memory of 596	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	26
PID 1672 wrote to memory of 596	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	26
PID 1672 wrote to memory of 596	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	26
PID 1672 wrote to memory of 596	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	26
PID 1672 wrote to memory of 596	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	26
PID 1672 wrote to memory of 596	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	26
PID 1672 wrote to memory of 596	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	26
PID 1672 wrote to memory of 676	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	25
PID 1672 wrote to memory of 676	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	25
PID 1672 wrote to memory of 676	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	25
PID 1672 wrote to memory of 676	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	25
PID 1672 wrote to memory of 676	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	25
PID 1672 wrote to memory of 676	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	25
PID 1672 wrote to memory of 676	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	25
PID 1672 wrote to memory of 748	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	24
PID 1672 wrote to memory of 748	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	24
PID 1672 wrote to memory of 748	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	24
PID 1672 wrote to memory of 748	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	24
PID 1672 wrote to memory of 748	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	24
PID 1672 wrote to memory of 748	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	24
PID 1672 wrote to memory of 748	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	24
PID 1672 wrote to memory of 800	1672	553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe	23

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:480

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:464
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:1216
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:1812
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1300
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1040
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:456
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:344
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:884
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:852
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:800
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:748
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:676
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:596
- C:\Windows\lsass.exe
  C:\Windows\lsass.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:1484

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:384

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:372
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:488

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:1940

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:2028

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1432
- C:\Users\Admin\AppData\Local\Temp\553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe
  "C:\Users\Admin\AppData\Local\Temp\553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1672

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\lsass.exe

Filesize
95KB

MD5
0cad3d0553648f39890f6f11ff42fd6e

SHA1
347dce5c5655e78b5ed35b17405f3f105cc80363

SHA256
553887fefd8c08cd96b1cb25505264c3e539443214cf3f7d046fdbf4c1dc6750

SHA512
17b92d0035d541ecdc1d770ce65d5df46de10f940e49d2abb41f11e12b4adfdb68f281cb365766ad8107d232d687a98e7646a7723239c21a59c3ca0b2dc6a7d4

Download Submit
memory/1484-61-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1484-62-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1672-55-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1672-54-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download
memory/1672-60-0x000000007EF90000-0x000000007EF9C000-memory.dmp

Filesize
48KB

Download
memory/1672-59-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download