77f56c0cc0f923dd763e4028d33bcb0d300e15c485602954b81d6a39ec1993ae

Analysis

max time kernel
29s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
21-03-2023 14:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe
Size

2.1MB
MD5

e03579a0e6f2881617a05ce524fe6176
SHA1

dd88c2948daf226985b6048deaa9ad577c7f2370
SHA256

95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee
SHA512

6cf5d6d4046ede733a3eb43f9815166ef9b105063019616c8a6dbb30a8ad74af6ee02af12e1174af982ca76ffe297172b0ce2306b3b22c79f85ef1542892c54d
SSDEEP

24576:ch3MhcNM1O05764Ym/GSdToQbE9roTuOFGydJ8MQ:chcPN6SZDwkA

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe

pid	process
1072	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe
1072	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe
1072	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe
1072	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe
1072	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe

description pid process

Token: SeDebugPrivilege 1072 95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe

description	pid	process
Token: SeDebugPrivilege	1072	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe

description	pid	process	target process
PID 1072 wrote to memory of 1704	1072	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe	MSBuild.exe
PID 1072 wrote to memory of 1704	1072	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe	MSBuild.exe
PID 1072 wrote to memory of 1704	1072	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe	MSBuild.exe
PID 1072 wrote to memory of 1704	1072	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe	MSBuild.exe
PID 1072 wrote to memory of 728	1072	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe	MSBuild.exe
PID 1072 wrote to memory of 728	1072	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe	MSBuild.exe
PID 1072 wrote to memory of 728	1072	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe	MSBuild.exe
PID 1072 wrote to memory of 728	1072	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe	MSBuild.exe
PID 1072 wrote to memory of 584	1072	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe	MSBuild.exe
PID 1072 wrote to memory of 584	1072	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe	MSBuild.exe
PID 1072 wrote to memory of 584	1072	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe	MSBuild.exe
PID 1072 wrote to memory of 584	1072	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe	MSBuild.exe
PID 1072 wrote to memory of 1184	1072	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe	MSBuild.exe
PID 1072 wrote to memory of 1184	1072	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe	MSBuild.exe
PID 1072 wrote to memory of 1184	1072	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe	MSBuild.exe
PID 1072 wrote to memory of 1184	1072	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe	MSBuild.exe
PID 1072 wrote to memory of 672	1072	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe	MSBuild.exe
PID 1072 wrote to memory of 672	1072	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe	MSBuild.exe
PID 1072 wrote to memory of 672	1072	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe	MSBuild.exe
PID 1072 wrote to memory of 672	1072	95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe
"C:\Users\Admin\AppData\Local\Temp\95205b407cd86cd1b2ddd85bfdaa67d9434c1757e9e8f9fc6b990eb78387f4ee.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1072

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
PID:1704

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
PID:728

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
PID:584

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
PID:1184

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
PID:672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1072-54-0x0000000000840000-0x0000000000A66000-memory.dmp

Filesize
2.1MB

Download
memory/1072-55-0x0000000000780000-0x0000000000792000-memory.dmp

Filesize
72KB

Download
memory/1072-56-0x0000000000800000-0x0000000000808000-memory.dmp

Filesize
32KB

Download
memory/1072-57-0x000000001B220000-0x000000001B2A0000-memory.dmp

Filesize
512KB

Download