72afe114ad4b8fd515e46dd2a26514ad13415ea35dbcf4eb544b96c6abf9fb28

Analysis

max time kernel
46s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
16/01/2023, 09:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
778740ad1608b3ae91132123e8e7132c.exe
Size 929KB
Sample230116-ll2pfsda94
SHA256 72afe114ad4b8fd515e46dd2a26514ad13415ea35dbcf4eb544b96c6abf9fb28
MD5 778740ad1608b3ae91132123e8e7132c
SHA1 bac8522672bd4b7ed56736168cc85c69b1b12ae2
SHA512 a89addec08138d952b7f9ee980ec1c8d3a153ca5bbaa8e1df23baa91d7195be45a43064a6749bff5a796fe83bfae921ff17ac4dc405600b9a983f3bf44dd61b3
SSDEEP 24576:uyPDJFb3ewHdqom7aTPierQDGalkYCmpDDL:HPDJFb/TaKML
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1428	778740ad1608b3ae91132123e8e7132c.exe
1428	778740ad1608b3ae91132123e8e7132c.exe
1428	778740ad1608b3ae91132123e8e7132c.exe
1428	778740ad1608b3ae91132123e8e7132c.exe
1428	778740ad1608b3ae91132123e8e7132c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1428	778740ad1608b3ae91132123e8e7132c.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 1136	1428	778740ad1608b3ae91132123e8e7132c.exe	26
PID 1428 wrote to memory of 1136	1428	778740ad1608b3ae91132123e8e7132c.exe	26
PID 1428 wrote to memory of 1136	1428	778740ad1608b3ae91132123e8e7132c.exe	26
PID 1428 wrote to memory of 1136	1428	778740ad1608b3ae91132123e8e7132c.exe	26
PID 1428 wrote to memory of 1296	1428	778740ad1608b3ae91132123e8e7132c.exe	27
PID 1428 wrote to memory of 1296	1428	778740ad1608b3ae91132123e8e7132c.exe	27
PID 1428 wrote to memory of 1296	1428	778740ad1608b3ae91132123e8e7132c.exe	27
PID 1428 wrote to memory of 1296	1428	778740ad1608b3ae91132123e8e7132c.exe	27
PID 1428 wrote to memory of 1272	1428	778740ad1608b3ae91132123e8e7132c.exe	28
PID 1428 wrote to memory of 1272	1428	778740ad1608b3ae91132123e8e7132c.exe	28
PID 1428 wrote to memory of 1272	1428	778740ad1608b3ae91132123e8e7132c.exe	28
PID 1428 wrote to memory of 1272	1428	778740ad1608b3ae91132123e8e7132c.exe	28
PID 1428 wrote to memory of 1228	1428	778740ad1608b3ae91132123e8e7132c.exe	29
PID 1428 wrote to memory of 1228	1428	778740ad1608b3ae91132123e8e7132c.exe	29
PID 1428 wrote to memory of 1228	1428	778740ad1608b3ae91132123e8e7132c.exe	29
PID 1428 wrote to memory of 1228	1428	778740ad1608b3ae91132123e8e7132c.exe	29
PID 1428 wrote to memory of 1916	1428	778740ad1608b3ae91132123e8e7132c.exe	30
PID 1428 wrote to memory of 1916	1428	778740ad1608b3ae91132123e8e7132c.exe	30
PID 1428 wrote to memory of 1916	1428	778740ad1608b3ae91132123e8e7132c.exe	30
PID 1428 wrote to memory of 1916	1428	778740ad1608b3ae91132123e8e7132c.exe	30

C:\Users\Admin\AppData\Local\Temp\778740ad1608b3ae91132123e8e7132c.exe
"C:\Users\Admin\AppData\Local\Temp\778740ad1608b3ae91132123e8e7132c.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Users\Admin\AppData\Local\Temp\778740ad1608b3ae91132123e8e7132c.exe
  "C:\Users\Admin\AppData\Local\Temp\778740ad1608b3ae91132123e8e7132c.exe"
  2⤵
  PID:1136
- C:\Users\Admin\AppData\Local\Temp\778740ad1608b3ae91132123e8e7132c.exe
  "C:\Users\Admin\AppData\Local\Temp\778740ad1608b3ae91132123e8e7132c.exe"
  2⤵
  PID:1296
- C:\Users\Admin\AppData\Local\Temp\778740ad1608b3ae91132123e8e7132c.exe
  "C:\Users\Admin\AppData\Local\Temp\778740ad1608b3ae91132123e8e7132c.exe"
  2⤵
  PID:1272
- C:\Users\Admin\AppData\Local\Temp\778740ad1608b3ae91132123e8e7132c.exe
  "C:\Users\Admin\AppData\Local\Temp\778740ad1608b3ae91132123e8e7132c.exe"
  2⤵
  PID:1228
- C:\Users\Admin\AppData\Local\Temp\778740ad1608b3ae91132123e8e7132c.exe
  "C:\Users\Admin\AppData\Local\Temp\778740ad1608b3ae91132123e8e7132c.exe"
  2⤵
  PID:1916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1428-54-0x0000000000390000-0x000000000047E000-memory.dmp

Download

memory/1428-55-0x00000000754E1000-0x00000000754E3000-memory.dmp

Download

memory/1428-56-0x00000000004A0000-0x00000000004B6000-memory.dmp

Download

memory/1428-57-0x00000000004C0000-0x00000000004CA000-memory.dmp

Download

memory/1428-58-0x00000000053C0000-0x0000000005448000-memory.dmp

Download

memory/1428-59-0x0000000000860000-0x00000000008B0000-memory.dmp

Download