a7e850ea4a967b6da743ea31ea7d1648d2707e747ec3749512a6ae5227c2e267

General

Target

a7e850ea4a967b6da743ea31ea7d1648d2707e747ec3749512a6ae5227c2e267.exe
Size

338KB
MD5

27a57aa8836bf66c35c9afcf6034e2a7
SHA1

884b76deea2e3c010562f523f6f20f7e2fe492c5
SHA256

a7e850ea4a967b6da743ea31ea7d1648d2707e747ec3749512a6ae5227c2e267
SHA512

77d6f15b52db80f570ef0cb46177dc5c1c4ce3c55ac231638ab59e4d4f41d6115ebc0810489c1e455e7f1e3030a0ec44d4993cd83ec091eeecfb1b7691304a2d
SSDEEP

6144:3Ih9SYWORnVFcK2ReJdhZ7hAgjHu03kLP:o9DWO1cKQS77bqlL

Score

6^/10

Malware Config

Signatures

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	a7e850ea4a967b6da743ea31ea7d1648d2707e747ec3749512a6ae5227c2e267.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	a7e850ea4a967b6da743ea31ea7d1648d2707e747ec3749512a6ae5227c2e267.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 220 set thread context of 3568	220	a7e850ea4a967b6da743ea31ea7d1648d2707e747ec3749512a6ae5227c2e267.exe	81
PID 3568 set thread context of 3728	3568	a7e850ea4a967b6da743ea31ea7d1648d2707e747ec3749512a6ae5227c2e267.exe	82

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\Desktop.ini	a7e850ea4a967b6da743ea31ea7d1648d2707e747ec3749512a6ae5227c2e267.exe
File opened for modification	C:\Windows\assembly	a7e850ea4a967b6da743ea31ea7d1648d2707e747ec3749512a6ae5227c2e267.exe
File created	C:\Windows\assembly\Desktop.ini	a7e850ea4a967b6da743ea31ea7d1648d2707e747ec3749512a6ae5227c2e267.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3728	a7e850ea4a967b6da743ea31ea7d1648d2707e747ec3749512a6ae5227c2e267.exe
3728	a7e850ea4a967b6da743ea31ea7d1648d2707e747ec3749512a6ae5227c2e267.exe
3728	a7e850ea4a967b6da743ea31ea7d1648d2707e747ec3749512a6ae5227c2e267.exe
3728	a7e850ea4a967b6da743ea31ea7d1648d2707e747ec3749512a6ae5227c2e267.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	220	a7e850ea4a967b6da743ea31ea7d1648d2707e747ec3749512a6ae5227c2e267.exe
Token: 33	220	a7e850ea4a967b6da743ea31ea7d1648d2707e747ec3749512a6ae5227c2e267.exe
Token: SeIncBasePriorityPrivilege	220	a7e850ea4a967b6da743ea31ea7d1648d2707e747ec3749512a6ae5227c2e267.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3568	a7e850ea4a967b6da743ea31ea7d1648d2707e747ec3749512a6ae5227c2e267.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 3568	220	a7e850ea4a967b6da743ea31ea7d1648d2707e747ec3749512a6ae5227c2e267.exe	81
PID 220 wrote to memory of 3568	220	a7e850ea4a967b6da743ea31ea7d1648d2707e747ec3749512a6ae5227c2e267.exe	81
PID 220 wrote to memory of 3568	220	a7e850ea4a967b6da743ea31ea7d1648d2707e747ec3749512a6ae5227c2e267.exe	81
PID 220 wrote to memory of 3568	220	a7e850ea4a967b6da743ea31ea7d1648d2707e747ec3749512a6ae5227c2e267.exe	81
PID 220 wrote to memory of 3568	220	a7e850ea4a967b6da743ea31ea7d1648d2707e747ec3749512a6ae5227c2e267.exe	81
PID 220 wrote to memory of 3568	220	a7e850ea4a967b6da743ea31ea7d1648d2707e747ec3749512a6ae5227c2e267.exe	81
PID 220 wrote to memory of 3568	220	a7e850ea4a967b6da743ea31ea7d1648d2707e747ec3749512a6ae5227c2e267.exe	81
PID 220 wrote to memory of 3568	220	a7e850ea4a967b6da743ea31ea7d1648d2707e747ec3749512a6ae5227c2e267.exe	81
PID 3568 wrote to memory of 3728	3568	a7e850ea4a967b6da743ea31ea7d1648d2707e747ec3749512a6ae5227c2e267.exe	82
PID 3568 wrote to memory of 3728	3568	a7e850ea4a967b6da743ea31ea7d1648d2707e747ec3749512a6ae5227c2e267.exe	82
PID 3568 wrote to memory of 3728	3568	a7e850ea4a967b6da743ea31ea7d1648d2707e747ec3749512a6ae5227c2e267.exe	82
PID 3568 wrote to memory of 3728	3568	a7e850ea4a967b6da743ea31ea7d1648d2707e747ec3749512a6ae5227c2e267.exe	82
PID 3568 wrote to memory of 3728	3568	a7e850ea4a967b6da743ea31ea7d1648d2707e747ec3749512a6ae5227c2e267.exe	82
PID 3568 wrote to memory of 3728	3568	a7e850ea4a967b6da743ea31ea7d1648d2707e747ec3749512a6ae5227c2e267.exe	82
PID 3568 wrote to memory of 3728	3568	a7e850ea4a967b6da743ea31ea7d1648d2707e747ec3749512a6ae5227c2e267.exe	82
PID 3728 wrote to memory of 1044	3728	a7e850ea4a967b6da743ea31ea7d1648d2707e747ec3749512a6ae5227c2e267.exe	32
PID 3728 wrote to memory of 1044	3728	a7e850ea4a967b6da743ea31ea7d1648d2707e747ec3749512a6ae5227c2e267.exe	32
PID 3728 wrote to memory of 1044	3728	a7e850ea4a967b6da743ea31ea7d1648d2707e747ec3749512a6ae5227c2e267.exe	32
PID 3728 wrote to memory of 1044	3728	a7e850ea4a967b6da743ea31ea7d1648d2707e747ec3749512a6ae5227c2e267.exe	32

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1044
- C:\Users\Admin\AppData\Local\Temp\a7e850ea4a967b6da743ea31ea7d1648d2707e747ec3749512a6ae5227c2e267.exe
  "C:\Users\Admin\AppData\Local\Temp\a7e850ea4a967b6da743ea31ea7d1648d2707e747ec3749512a6ae5227c2e267.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:220
- - C:\Users\Admin\AppData\Local\Temp\a7e850ea4a967b6da743ea31ea7d1648d2707e747ec3749512a6ae5227c2e267.exe
    "C:\Users\Admin\AppData\Local\Temp\a7e850ea4a967b6da743ea31ea7d1648d2707e747ec3749512a6ae5227c2e267.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3568
  - - C:\Users\Admin\AppData\Local\Temp\a7e850ea4a967b6da743ea31ea7d1648d2707e747ec3749512a6ae5227c2e267.exe
      "C:\Users\Admin\AppData\Local\Temp\a7e850ea4a967b6da743ea31ea7d1648d2707e747ec3749512a6ae5227c2e267.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/220-133-0x0000000074880000-0x0000000074E31000-memory.dmp

Filesize
5.7MB

Download
memory/220-138-0x0000000074880000-0x0000000074E31000-memory.dmp

Filesize
5.7MB

Download
memory/220-132-0x0000000074880000-0x0000000074E31000-memory.dmp

Filesize
5.7MB

Download
memory/1044-147-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3568-145-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/3568-135-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/3568-137-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/3728-146-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3728-144-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3728-142-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3728-148-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing