c00a83724a4b7b90d84575fca16ff915ef106546c621113ee8e964facaf47d40

Analysis

max time kernel
124s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 12:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c00a83724a4b7b90d84575fca16ff915ef106546c621113ee8e964facaf47d40.exe
Size

18KB
MD5

174b08d9d9bb714de054c26679bdb9fa
SHA1

24b9ce6fb9d5d0f3d9dc2b7c87746ca4d1bad58f
SHA256

c00a83724a4b7b90d84575fca16ff915ef106546c621113ee8e964facaf47d40
SHA512

c0ea57dbf679047e24c038849e96a57694166ede8b620c1525b7eb96e8d1652f451b162bb19c2600b504431bf0dd159785f772bc43a5fc2e61da464bc3d8f3b8
SSDEEP

384:ycf78sBkP9bmdRWOw6wK1s5TkLC91ooiI9pU:IsyP9bmTWL0OswBiUpU

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
1448	325792499f4cbb6f.exe
1980	325792499f4cbb6f.exe
1904	325792499f4cbb6f.exe
1940	325792499f4cbb6f.exe
896	325792499f4cbb6f.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\.325792499f4cbb6f\325792499f4cbb6f.exe	c00a83724a4b7b90d84575fca16ff915ef106546c621113ee8e964facaf47d40.exe
File opened for modification	C:\Windows\SysWOW64\.325792499f4cbb6f\325792499f4cbb6f.exe	c00a83724a4b7b90d84575fca16ff915ef106546c621113ee8e964facaf47d40.exe
File opened for modification	C:\Windows\SysWOW64\.325792499f4cbb6f	c00a83724a4b7b90d84575fca16ff915ef106546c621113ee8e964facaf47d40.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	900	c00a83724a4b7b90d84575fca16ff915ef106546c621113ee8e964facaf47d40.exe
Token: SeDebugPrivilege	1448	325792499f4cbb6f.exe
Token: SeDebugPrivilege	1980	325792499f4cbb6f.exe
Token: SeDebugPrivilege	1904	325792499f4cbb6f.exe
Token: SeDebugPrivilege	1940	325792499f4cbb6f.exe
Token: SeDebugPrivilege	896	325792499f4cbb6f.exe

C:\Users\Admin\AppData\Local\Temp\c00a83724a4b7b90d84575fca16ff915ef106546c621113ee8e964facaf47d40.exe
"C:\Users\Admin\AppData\Local\Temp\c00a83724a4b7b90d84575fca16ff915ef106546c621113ee8e964facaf47d40.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:900

C:\Windows\SysWOW64\.325792499f4cbb6f\325792499f4cbb6f.exe
C:\Windows\SysWOW64\.325792499f4cbb6f\325792499f4cbb6f.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1448

C:\Windows\SysWOW64\.325792499f4cbb6f\325792499f4cbb6f.exe
C:\Windows\SysWOW64\.325792499f4cbb6f\325792499f4cbb6f.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1980

C:\Windows\SysWOW64\.325792499f4cbb6f\325792499f4cbb6f.exe
C:\Windows\SysWOW64\.325792499f4cbb6f\325792499f4cbb6f.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1904

C:\Windows\SysWOW64\.325792499f4cbb6f\325792499f4cbb6f.exe
C:\Windows\SysWOW64\.325792499f4cbb6f\325792499f4cbb6f.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1940

C:\Windows\SysWOW64\.325792499f4cbb6f\325792499f4cbb6f.exe
C:\Windows\SysWOW64\.325792499f4cbb6f\325792499f4cbb6f.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\.325792499f4cbb6f\325792499f4cbb6f.exe

Filesize
18KB

MD5
174b08d9d9bb714de054c26679bdb9fa

SHA1
24b9ce6fb9d5d0f3d9dc2b7c87746ca4d1bad58f

SHA256
c00a83724a4b7b90d84575fca16ff915ef106546c621113ee8e964facaf47d40

SHA512
c0ea57dbf679047e24c038849e96a57694166ede8b620c1525b7eb96e8d1652f451b162bb19c2600b504431bf0dd159785f772bc43a5fc2e61da464bc3d8f3b8

Download Submit
C:\Windows\SysWOW64\.325792499f4cbb6f\325792499f4cbb6f.exe

Filesize
18KB

MD5
174b08d9d9bb714de054c26679bdb9fa

SHA1
24b9ce6fb9d5d0f3d9dc2b7c87746ca4d1bad58f

SHA256
c00a83724a4b7b90d84575fca16ff915ef106546c621113ee8e964facaf47d40

SHA512
c0ea57dbf679047e24c038849e96a57694166ede8b620c1525b7eb96e8d1652f451b162bb19c2600b504431bf0dd159785f772bc43a5fc2e61da464bc3d8f3b8

Download Submit
C:\Windows\SysWOW64\.325792499f4cbb6f\325792499f4cbb6f.exe

Filesize
18KB

MD5
174b08d9d9bb714de054c26679bdb9fa

SHA1
24b9ce6fb9d5d0f3d9dc2b7c87746ca4d1bad58f

SHA256
c00a83724a4b7b90d84575fca16ff915ef106546c621113ee8e964facaf47d40

SHA512
c0ea57dbf679047e24c038849e96a57694166ede8b620c1525b7eb96e8d1652f451b162bb19c2600b504431bf0dd159785f772bc43a5fc2e61da464bc3d8f3b8

Download Submit
C:\Windows\SysWOW64\.325792499f4cbb6f\325792499f4cbb6f.exe

Filesize
18KB

MD5
174b08d9d9bb714de054c26679bdb9fa

SHA1
24b9ce6fb9d5d0f3d9dc2b7c87746ca4d1bad58f

SHA256
c00a83724a4b7b90d84575fca16ff915ef106546c621113ee8e964facaf47d40

SHA512
c0ea57dbf679047e24c038849e96a57694166ede8b620c1525b7eb96e8d1652f451b162bb19c2600b504431bf0dd159785f772bc43a5fc2e61da464bc3d8f3b8

Download Submit
C:\Windows\SysWOW64\.325792499f4cbb6f\325792499f4cbb6f.exe

Filesize
18KB

MD5
174b08d9d9bb714de054c26679bdb9fa

SHA1
24b9ce6fb9d5d0f3d9dc2b7c87746ca4d1bad58f

SHA256
c00a83724a4b7b90d84575fca16ff915ef106546c621113ee8e964facaf47d40

SHA512
c0ea57dbf679047e24c038849e96a57694166ede8b620c1525b7eb96e8d1652f451b162bb19c2600b504431bf0dd159785f772bc43a5fc2e61da464bc3d8f3b8

Download Submit
memory/900-54-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads