95a57f2b4650583718a4128a5bb80246b0be0377803b0383677893109588c348

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
21-03-2023 13:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe
Size

2.1MB
MD5

e03579a0e6f2881617a05ce524fe6176
SHA1

dd88c2948daf226985b6048deaa9ad577c7f2370
SHA256

95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee
SHA512

6cf5d6d4046ede733a3eb43f9815166ef9b105063019616c8a6dbb30a8ad74af6ee02af12e1174af982ca76ffe297172b0ce2306b3b22c79f85ef1542892c54d
SSDEEP

24576:ch3MhcNM1O05764Ym/GSdToQbE9roTuOFGydJ8MQ:chcPN6SZDwkA

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe

pid	process
1204	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe
1204	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe
1204	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe
1204	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe
1204	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe

description pid process

Token: SeDebugPrivilege 1204 95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe

description	pid	process
Token: SeDebugPrivilege	1204	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe

description	pid	process	target process
PID 1204 wrote to memory of 2040	1204	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe	MSBuild.exe
PID 1204 wrote to memory of 2040	1204	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe	MSBuild.exe
PID 1204 wrote to memory of 2040	1204	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe	MSBuild.exe
PID 1204 wrote to memory of 2040	1204	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe	MSBuild.exe
PID 1204 wrote to memory of 2032	1204	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe	MSBuild.exe
PID 1204 wrote to memory of 2032	1204	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe	MSBuild.exe
PID 1204 wrote to memory of 2032	1204	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe	MSBuild.exe
PID 1204 wrote to memory of 2032	1204	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe	MSBuild.exe
PID 1204 wrote to memory of 1780	1204	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe	MSBuild.exe
PID 1204 wrote to memory of 1780	1204	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe	MSBuild.exe
PID 1204 wrote to memory of 1780	1204	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe	MSBuild.exe
PID 1204 wrote to memory of 1780	1204	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe	MSBuild.exe
PID 1204 wrote to memory of 1496	1204	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe	MSBuild.exe
PID 1204 wrote to memory of 1496	1204	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe	MSBuild.exe
PID 1204 wrote to memory of 1496	1204	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe	MSBuild.exe
PID 1204 wrote to memory of 1496	1204	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe	MSBuild.exe
PID 1204 wrote to memory of 700	1204	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe	MSBuild.exe
PID 1204 wrote to memory of 700	1204	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe	MSBuild.exe
PID 1204 wrote to memory of 700	1204	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe	MSBuild.exe
PID 1204 wrote to memory of 700	1204	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe
"C:\Users\Admin\AppData\Local\Temp\95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1204

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
PID:2040

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
PID:2032

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
PID:1780

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
PID:1496

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
PID:700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1204-54-0x00000000003C0000-0x00000000005E6000-memory.dmp

Filesize
2.1MB

Download
memory/1204-55-0x0000000000150000-0x0000000000162000-memory.dmp

Filesize
72KB

Download
memory/1204-56-0x0000000000160000-0x0000000000168000-memory.dmp

Filesize
32KB

Download