c27d23348439e75730e49644b525681e74b09848ea879276274b88676c3fff90

Analysis

max time kernel
215s
max time network
299s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c27d23348439e75730e49644b525681e74b09848ea879276274b88676c3fff90.exe
Size

563KB
MD5

eaf2f522ed0d5f9ea6a088003954abaa
SHA1

07cf38ca88d08bdf008a4a7c57580a0629e078c1
SHA256

c27d23348439e75730e49644b525681e74b09848ea879276274b88676c3fff90
SHA512

9a37876df42520e5d43628f139bc7d27aa8b35116a92a8d54ba09beaaf6e78ef6da682f8974c7414e3fc90f4cbb6a7d3978c2dae535de7bb99cec93f4237bd4b
SSDEEP

12288:B+SZsGkEp3gos8uXY4cO/gqhd+3C5+qQUjJUU4QdxIYDdtWnI+NKnw/LN:4SrkEp3W8AD/Dhd+y4lqJ8QdCYDoDNKo

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1692	sxe2C8D.tmp
1112	zvguvo.exe

Loads dropped DLL 2 IoCs

pid	Process
668	c27d23348439e75730e49644b525681e74b09848ea879276274b88676c3fff90.exe
668	c27d23348439e75730e49644b525681e74b09848ea879276274b88676c3fff90.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\zvguvo.exe	sxe2C8D.tmp
File opened for modification	C:\Windows\SysWOW64\zvguvo.exe	sxe2C8D.tmp

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1692	sxe2C8D.tmp

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 668 wrote to memory of 1692	668	c27d23348439e75730e49644b525681e74b09848ea879276274b88676c3fff90.exe	28
PID 668 wrote to memory of 1692	668	c27d23348439e75730e49644b525681e74b09848ea879276274b88676c3fff90.exe	28
PID 668 wrote to memory of 1692	668	c27d23348439e75730e49644b525681e74b09848ea879276274b88676c3fff90.exe	28
PID 668 wrote to memory of 1692	668	c27d23348439e75730e49644b525681e74b09848ea879276274b88676c3fff90.exe	28
PID 1692 wrote to memory of 676	1692	sxe2C8D.tmp	30
PID 1692 wrote to memory of 676	1692	sxe2C8D.tmp	30
PID 1692 wrote to memory of 676	1692	sxe2C8D.tmp	30
PID 1692 wrote to memory of 676	1692	sxe2C8D.tmp	30

C:\Users\Admin\AppData\Local\Temp\c27d23348439e75730e49644b525681e74b09848ea879276274b88676c3fff90.exe
"C:\Users\Admin\AppData\Local\Temp\c27d23348439e75730e49644b525681e74b09848ea879276274b88676c3fff90.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:668
- C:\Users\Admin\AppData\Local\Temp\sxe2C8D.tmp
  "C:\Users\Admin\AppData\Local\Temp\sxe2C8D.tmp"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\sxe2C8D.tmp > nul
    3⤵
    PID:676

C:\Windows\SysWOW64\zvguvo.exe
C:\Windows\SysWOW64\zvguvo.exe
1⤵
- Executes dropped EXE
PID:1112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\sxe2C8D.tmp

Filesize
65KB

MD5
f92202279cfce75aedc69952a509238b

SHA1
040186324d91ac2046ae5055274fd1248f4e4a98

SHA256
d52b101edf5c36471faf2e064f6eacd59d95cbd3cd02079278f6a8dc35455830

SHA512
85e1010ea4baec6b113e319f12816a9baeabbb777eec7a649b3eb4739f2c0df99b83cb54846286166afd74a999d040070ae978da54e72813bf58f2fa5fe93a31

Download Submit
C:\Users\Admin\AppData\Local\Temp\sxe2C8D.tmp

Filesize
65KB

MD5
f92202279cfce75aedc69952a509238b

SHA1
040186324d91ac2046ae5055274fd1248f4e4a98

SHA256
d52b101edf5c36471faf2e064f6eacd59d95cbd3cd02079278f6a8dc35455830

SHA512
85e1010ea4baec6b113e319f12816a9baeabbb777eec7a649b3eb4739f2c0df99b83cb54846286166afd74a999d040070ae978da54e72813bf58f2fa5fe93a31

Download Submit
C:\Windows\SysWOW64\zvguvo.exe

Filesize
65KB

MD5
f92202279cfce75aedc69952a509238b

SHA1
040186324d91ac2046ae5055274fd1248f4e4a98

SHA256
d52b101edf5c36471faf2e064f6eacd59d95cbd3cd02079278f6a8dc35455830

SHA512
85e1010ea4baec6b113e319f12816a9baeabbb777eec7a649b3eb4739f2c0df99b83cb54846286166afd74a999d040070ae978da54e72813bf58f2fa5fe93a31

Download Submit
\Users\Admin\AppData\Local\Temp\sxe2C8D.tmp

Filesize
65KB

MD5
f92202279cfce75aedc69952a509238b

SHA1
040186324d91ac2046ae5055274fd1248f4e4a98

SHA256
d52b101edf5c36471faf2e064f6eacd59d95cbd3cd02079278f6a8dc35455830

SHA512
85e1010ea4baec6b113e319f12816a9baeabbb777eec7a649b3eb4739f2c0df99b83cb54846286166afd74a999d040070ae978da54e72813bf58f2fa5fe93a31

Download Submit
\Users\Admin\AppData\Local\Temp\sxe2C8D.tmp

Filesize
65KB

MD5
f92202279cfce75aedc69952a509238b

SHA1
040186324d91ac2046ae5055274fd1248f4e4a98

SHA256
d52b101edf5c36471faf2e064f6eacd59d95cbd3cd02079278f6a8dc35455830

SHA512
85e1010ea4baec6b113e319f12816a9baeabbb777eec7a649b3eb4739f2c0df99b83cb54846286166afd74a999d040070ae978da54e72813bf58f2fa5fe93a31

Download Submit
memory/1692-58-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download