431d5ac94ffcc12e9ff48e227ba286736ba47a50e6afd8f1ac2d9bf4a1b9fd33

Analysis

max time kernel
79s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
21/03/2023, 11:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
708be0d87c2de77618729c3c886e1d51.exe
Size 790KB
Sample230321-ntfhasaa74
SHA256 431d5ac94ffcc12e9ff48e227ba286736ba47a50e6afd8f1ac2d9bf4a1b9fd33
MD5 708be0d87c2de77618729c3c886e1d51
SHA1 68b7939873e7aba3112e6b51a3cfd2b8b43a2749
SHA512 45b17cc1c6a2b79853a3907dd32e0ae2967ece57f801b7897547f04ac2179e82582479c9916822c44b9f45a7015f62e05fd38c00dde0b5f11b01d00787fda800
SSDEEP 24576:ie01vNe4sKsFWhjcn5vH2CQzagk1bMOn3qfjt1Q:iGaVhI56Ogk5Habt6
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2028	708be0d87c2de77618729c3c886e1d51.exe
2028	708be0d87c2de77618729c3c886e1d51.exe
2028	708be0d87c2de77618729c3c886e1d51.exe
2028	708be0d87c2de77618729c3c886e1d51.exe
2028	708be0d87c2de77618729c3c886e1d51.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2028	708be0d87c2de77618729c3c886e1d51.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1060	2028	708be0d87c2de77618729c3c886e1d51.exe	28
PID 2028 wrote to memory of 1060	2028	708be0d87c2de77618729c3c886e1d51.exe	28
PID 2028 wrote to memory of 1060	2028	708be0d87c2de77618729c3c886e1d51.exe	28
PID 2028 wrote to memory of 1060	2028	708be0d87c2de77618729c3c886e1d51.exe	28
PID 2028 wrote to memory of 1108	2028	708be0d87c2de77618729c3c886e1d51.exe	29
PID 2028 wrote to memory of 1108	2028	708be0d87c2de77618729c3c886e1d51.exe	29
PID 2028 wrote to memory of 1108	2028	708be0d87c2de77618729c3c886e1d51.exe	29
PID 2028 wrote to memory of 1108	2028	708be0d87c2de77618729c3c886e1d51.exe	29
PID 2028 wrote to memory of 676	2028	708be0d87c2de77618729c3c886e1d51.exe	30
PID 2028 wrote to memory of 676	2028	708be0d87c2de77618729c3c886e1d51.exe	30
PID 2028 wrote to memory of 676	2028	708be0d87c2de77618729c3c886e1d51.exe	30
PID 2028 wrote to memory of 676	2028	708be0d87c2de77618729c3c886e1d51.exe	30
PID 2028 wrote to memory of 1384	2028	708be0d87c2de77618729c3c886e1d51.exe	31
PID 2028 wrote to memory of 1384	2028	708be0d87c2de77618729c3c886e1d51.exe	31
PID 2028 wrote to memory of 1384	2028	708be0d87c2de77618729c3c886e1d51.exe	31
PID 2028 wrote to memory of 1384	2028	708be0d87c2de77618729c3c886e1d51.exe	31
PID 2028 wrote to memory of 320	2028	708be0d87c2de77618729c3c886e1d51.exe	32
PID 2028 wrote to memory of 320	2028	708be0d87c2de77618729c3c886e1d51.exe	32
PID 2028 wrote to memory of 320	2028	708be0d87c2de77618729c3c886e1d51.exe	32
PID 2028 wrote to memory of 320	2028	708be0d87c2de77618729c3c886e1d51.exe	32

C:\Users\Admin\AppData\Local\Temp\708be0d87c2de77618729c3c886e1d51.exe
"C:\Users\Admin\AppData\Local\Temp\708be0d87c2de77618729c3c886e1d51.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Users\Admin\AppData\Local\Temp\708be0d87c2de77618729c3c886e1d51.exe
  "C:\Users\Admin\AppData\Local\Temp\708be0d87c2de77618729c3c886e1d51.exe"
  2⤵
  PID:1060
- C:\Users\Admin\AppData\Local\Temp\708be0d87c2de77618729c3c886e1d51.exe
  "C:\Users\Admin\AppData\Local\Temp\708be0d87c2de77618729c3c886e1d51.exe"
  2⤵
  PID:1108
- C:\Users\Admin\AppData\Local\Temp\708be0d87c2de77618729c3c886e1d51.exe
  "C:\Users\Admin\AppData\Local\Temp\708be0d87c2de77618729c3c886e1d51.exe"
  2⤵
  PID:676
- C:\Users\Admin\AppData\Local\Temp\708be0d87c2de77618729c3c886e1d51.exe
  "C:\Users\Admin\AppData\Local\Temp\708be0d87c2de77618729c3c886e1d51.exe"
  2⤵
  PID:1384
- C:\Users\Admin\AppData\Local\Temp\708be0d87c2de77618729c3c886e1d51.exe
  "C:\Users\Admin\AppData\Local\Temp\708be0d87c2de77618729c3c886e1d51.exe"
  2⤵
  PID:320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2028-54-0x0000000000360000-0x000000000042C000-memory.dmp

Download

memory/2028-55-0x0000000004AB0000-0x0000000004AF0000-memory.dmp

Download

memory/2028-56-0x0000000004FE0000-0x00000000050B0000-memory.dmp

Download

memory/2028-57-0x0000000004AB0000-0x0000000004AF0000-memory.dmp

Download

memory/2028-58-0x0000000000320000-0x0000000000334000-memory.dmp

Download

memory/2028-59-0x0000000000330000-0x000000000033C000-memory.dmp

Download

memory/2028-60-0x0000000005E20000-0x0000000005ECC000-memory.dmp

Download

memory/2028-61-0x0000000002040000-0x0000000002072000-memory.dmp

Download