c87944569ee3472607f5c02b5d249c6d817de90c4c143349a0905b2a8c6284ef

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
20-05-2023 21:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9247803ef08a9aaaa9c9f4595d5946e0.exe
Size

2.1MB
MD5

9247803ef08a9aaaa9c9f4595d5946e0
SHA1

774ec9e0cdfe0816703960039e0a21af5dd94b46
SHA256

c87944569ee3472607f5c02b5d249c6d817de90c4c143349a0905b2a8c6284ef
SHA512

245d9289daa37eb287c3de3ac2b621104415907d4b3bdc08ba47ed90fd7c51fafd29c0439f44e81ce22941f9393eb92d1359fa4a79c8a78261174e515c5f4abf
SSDEEP

49152:IlCF2ZorKJtQvwAqyoWNN1HdFvo9ZYPWp6:39wAqyoW93voZYPz

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1400	9247803ef08a9aaaa9c9f4595d5946e0.exe
1400	9247803ef08a9aaaa9c9f4595d5946e0.exe
1400	9247803ef08a9aaaa9c9f4595d5946e0.exe
1400	9247803ef08a9aaaa9c9f4595d5946e0.exe
1400	9247803ef08a9aaaa9c9f4595d5946e0.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1400	9247803ef08a9aaaa9c9f4595d5946e0.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 1908	1400	9247803ef08a9aaaa9c9f4595d5946e0.exe	28
PID 1400 wrote to memory of 1908	1400	9247803ef08a9aaaa9c9f4595d5946e0.exe	28
PID 1400 wrote to memory of 1908	1400	9247803ef08a9aaaa9c9f4595d5946e0.exe	28
PID 1400 wrote to memory of 1908	1400	9247803ef08a9aaaa9c9f4595d5946e0.exe	28
PID 1400 wrote to memory of 1072	1400	9247803ef08a9aaaa9c9f4595d5946e0.exe	29
PID 1400 wrote to memory of 1072	1400	9247803ef08a9aaaa9c9f4595d5946e0.exe	29
PID 1400 wrote to memory of 1072	1400	9247803ef08a9aaaa9c9f4595d5946e0.exe	29
PID 1400 wrote to memory of 1072	1400	9247803ef08a9aaaa9c9f4595d5946e0.exe	29
PID 1400 wrote to memory of 584	1400	9247803ef08a9aaaa9c9f4595d5946e0.exe	30
PID 1400 wrote to memory of 584	1400	9247803ef08a9aaaa9c9f4595d5946e0.exe	30
PID 1400 wrote to memory of 584	1400	9247803ef08a9aaaa9c9f4595d5946e0.exe	30
PID 1400 wrote to memory of 584	1400	9247803ef08a9aaaa9c9f4595d5946e0.exe	30
PID 1400 wrote to memory of 1220	1400	9247803ef08a9aaaa9c9f4595d5946e0.exe	31
PID 1400 wrote to memory of 1220	1400	9247803ef08a9aaaa9c9f4595d5946e0.exe	31
PID 1400 wrote to memory of 1220	1400	9247803ef08a9aaaa9c9f4595d5946e0.exe	31
PID 1400 wrote to memory of 1220	1400	9247803ef08a9aaaa9c9f4595d5946e0.exe	31
PID 1400 wrote to memory of 1460	1400	9247803ef08a9aaaa9c9f4595d5946e0.exe	32
PID 1400 wrote to memory of 1460	1400	9247803ef08a9aaaa9c9f4595d5946e0.exe	32
PID 1400 wrote to memory of 1460	1400	9247803ef08a9aaaa9c9f4595d5946e0.exe	32
PID 1400 wrote to memory of 1460	1400	9247803ef08a9aaaa9c9f4595d5946e0.exe	32

C:\Users\Admin\AppData\Local\Temp\9247803ef08a9aaaa9c9f4595d5946e0.exe
"C:\Users\Admin\AppData\Local\Temp\9247803ef08a9aaaa9c9f4595d5946e0.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Users\Admin\AppData\Local\Temp\9247803ef08a9aaaa9c9f4595d5946e0.exe
  "{path}"
  2⤵
  PID:1908
- C:\Users\Admin\AppData\Local\Temp\9247803ef08a9aaaa9c9f4595d5946e0.exe
  "{path}"
  2⤵
  PID:1072
- C:\Users\Admin\AppData\Local\Temp\9247803ef08a9aaaa9c9f4595d5946e0.exe
  "{path}"
  2⤵
  PID:584
- C:\Users\Admin\AppData\Local\Temp\9247803ef08a9aaaa9c9f4595d5946e0.exe
  "{path}"
  2⤵
  PID:1220
- C:\Users\Admin\AppData\Local\Temp\9247803ef08a9aaaa9c9f4595d5946e0.exe
  "{path}"
  2⤵
  PID:1460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1400-54-0x0000000000300000-0x000000000051A000-memory.dmp

Filesize
2.1MB

Download
memory/1400-55-0x0000000004E40000-0x0000000004E80000-memory.dmp

Filesize
256KB

Download
memory/1400-56-0x00000000002E0000-0x00000000002F4000-memory.dmp

Filesize
80KB

Download
memory/1400-57-0x0000000004E40000-0x0000000004E80000-memory.dmp

Filesize
256KB

Download
memory/1400-58-0x0000000008050000-0x00000000081F4000-memory.dmp

Filesize
1.6MB

Download
memory/1400-59-0x000000000B7E0000-0x000000000B932000-memory.dmp

Filesize
1.3MB

Download