85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 12:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe
Size

32KB
MD5

35f10b14382748a5c02de35a811ee126
SHA1

376ba3cc7aadb61331b4209a4fac3bee611bc69e
SHA256

85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39
SHA512

c08ca9c750b686c2d745c983fd667f58f70c531214d7973ae3eb930ba5ec32b662d40e5a33eb03236cc7e3f2af13b2765030362e7d3e192f6cbe3ad7088feb48
SSDEEP

384:LxGOfCE0nZ6sFdVqaVzX1tZ6ku7AK4ZFv:NWhZ/dVpVzFVM

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\secure32.html	85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe
File opened for modification	\??\c:\Program Files\nicr.exe	85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\hosts	85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
856	85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe
856	85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe
856	85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe
856	85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe
856	85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe
856	85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe
856	85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe
856	85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe
856	85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe
856	85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe
856	85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe
856	85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe
856	85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe
856	85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe
856	85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe
856	85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe
856	85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe
856	85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe
856	85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe
856	85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe
856	85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe
856	85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	856	85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe

C:\Users\Admin\AppData\Local\Temp\85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe
"C:\Users\Admin\AppData\Local\Temp\85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/856-54-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download