Analysis

  • max time kernel
    22s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    21/01/2023, 22:18

General

  • Target

    ad64a6e6e563e0aa8afcf4ce2e001363a20d8fcd5b6f6b0003329ce1f543f5bc.exe

  • Size

    268KB

  • MD5

    50a3cdeb5ecd78be788dd9232db6fa79

  • SHA1

    baef08dfe4b9ec5abc00aefa81d3656952e07b37

  • SHA256

    ad64a6e6e563e0aa8afcf4ce2e001363a20d8fcd5b6f6b0003329ce1f543f5bc

  • SHA512

    255bb8133a62a9bc49fea8933217639fb3191648c5403cb4972865ecc53cccda4f1a3f90278a9e08d78e7cc3376047472cfae364184b8ef8b9d420f10a7aaf3d

  • SSDEEP

    3072:gpE5D8eEcnqm7h+UpV4Uqdd84sIDSQKyYyPuev/9LmAx7wAoBtgsWrYkgx1IPP:twcnqpU0dduIDAyPug/9LmAx7wRH1IPP

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ad64a6e6e563e0aa8afcf4ce2e001363a20d8fcd5b6f6b0003329ce1f543f5bc.exe
    "C:\Users\Admin\AppData\Local\Temp\ad64a6e6e563e0aa8afcf4ce2e001363a20d8fcd5b6f6b0003329ce1f543f5bc.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2024
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:/Windows/SysWOW64/WindowsPowerShell/v1.0/powershell.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/596-58-0x00000000744E0000-0x0000000074A8B000-memory.dmp

    Filesize

    5.7MB

  • memory/596-59-0x00000000744E0000-0x0000000074A8B000-memory.dmp

    Filesize

    5.7MB

  • memory/2024-54-0x00000000013C0000-0x0000000001404000-memory.dmp

    Filesize

    272KB

  • memory/2024-55-0x00000000760D1000-0x00000000760D3000-memory.dmp

    Filesize

    8KB