Overview

overview

7

Static

static

aaa714d542...e3.exe

windows7-x64

7

aaa714d542...e3.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    43s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    03/12/2022, 15:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    aaa714d542bdd7af674135c44fd5d3240529b3a7c2a9751685e490c0415512e3.exe

  • Size

    139KB

  • MD5

    417f7409f456961ba1c0d958ac24ffc1

  • SHA1

    13ef512bf0d5381a2ae128a99d3b84f32ad67e37

  • SHA256

    aaa714d542bdd7af674135c44fd5d3240529b3a7c2a9751685e490c0415512e3

  • SHA512

    95bf483b786406173ca0590a555926bd9d83caf0689440c6424a52aac8031384ac1294ecc3c31853cdf0aaf0b9616cb5021131260cd3ef33de9436517634e573

  • SSDEEP

    3072:EDqyvs61w5uHoF/vbWXFRQHazpuIcwyN17RK3+WAn3ql:w/vq5ucycGuYyvRKxC

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aaa714d542bdd7af674135c44fd5d3240529b3a7c2a9751685e490c0415512e3.exe
    "C:\Users\Admin\AppData\Local\Temp\aaa714d542bdd7af674135c44fd5d3240529b3a7c2a9751685e490c0415512e3.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:564
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
        PID:1388

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Users\Admin\AppData\Local\Temp\8C8.tmp
      Filesize

      1.2MB

      MD5

      d124f55b9393c976963407dff51ffa79

      SHA1

      2c7bbedd79791bfb866898c85b504186db610b5d

      SHA256

      ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

      SHA512

      278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

      Download Submit

    • \Users\Admin\AppData\Local\Temp\907.tmp
      Filesize

      1.1MB

      MD5

      9b98d47916ead4f69ef51b56b0c2323c

      SHA1

      290a80b4ded0efc0fd00816f373fcea81a521330

      SHA256

      96e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b

      SHA512

      68b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94

      Download Submit

    • \Users\Admin\AppData\Local\Temp\956.tmp
      Filesize

      202KB

      MD5

      7ff15a4f092cd4a96055ba69f903e3e9

      SHA1

      a3d338a38c2b92f95129814973f59446668402a8

      SHA256

      1b594e6d057c632abb3a8cf838157369024bd6b9f515ca8e774b22fe71a11627

      SHA512

      4b015d011c14c7e10568c09bf81894681535efb7d76c3ef9071fffb3837f62b36e695187b2d32581a30f07e79971054e231a2ca4e8ad7f0f83d5876f8c086dae

      Download Submit

    • memory/564-54-0x0000000074AD1000-0x0000000074AD3000-memory.dmp

      Filesize

      8KB

      Download

    • memory/564-58-0x0000000000020000-0x000000000003D000-memory.dmp

      Filesize

      116KB

      Download

    • memory/564-59-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

      Download