a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba

Analysis

max time kernel
32s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
23-05-2023 22:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe
Size

2.7MB
MD5

e7bf9f0c2c1977ddd8e139c13c27be0d
SHA1

e91aff3d9a8c7cef0e9543350864971e4ad93f82
SHA256

a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba
SHA512

d9961824b178944aec2411c1bb29a5ef4b487ce0c251fe381e2841c6abe00f29ecf895ab1baf93e49442af07a14acdcf9d882519d39beb5c4d4902db2db2560f
SSDEEP

49152:552sxwTr/VsoJteujcnqNwelN/z52r7zj9n0cqv/3SYd:55jxa3JteujcncNNQzj9hqXCY

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1148	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe
1148	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe
1148	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe
1148	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe
1148	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1148	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 752	1148	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	28
PID 1148 wrote to memory of 752	1148	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	28
PID 1148 wrote to memory of 752	1148	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	28
PID 1148 wrote to memory of 752	1148	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	28
PID 1148 wrote to memory of 564	1148	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	29
PID 1148 wrote to memory of 564	1148	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	29
PID 1148 wrote to memory of 564	1148	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	29
PID 1148 wrote to memory of 564	1148	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	29
PID 1148 wrote to memory of 560	1148	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	30
PID 1148 wrote to memory of 560	1148	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	30
PID 1148 wrote to memory of 560	1148	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	30
PID 1148 wrote to memory of 560	1148	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	30
PID 1148 wrote to memory of 2028	1148	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	31
PID 1148 wrote to memory of 2028	1148	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	31
PID 1148 wrote to memory of 2028	1148	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	31
PID 1148 wrote to memory of 2028	1148	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	31
PID 1148 wrote to memory of 1180	1148	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	32
PID 1148 wrote to memory of 1180	1148	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	32
PID 1148 wrote to memory of 1180	1148	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	32
PID 1148 wrote to memory of 1180	1148	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	32

C:\Users\Admin\AppData\Local\Temp\a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe
"C:\Users\Admin\AppData\Local\Temp\a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Users\Admin\AppData\Local\Temp\a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe
  "{path}"
  2⤵
  PID:752
- C:\Users\Admin\AppData\Local\Temp\a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe
  "{path}"
  2⤵
  PID:564
- C:\Users\Admin\AppData\Local\Temp\a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe
  "{path}"
  2⤵
  PID:560
- C:\Users\Admin\AppData\Local\Temp\a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe
  "{path}"
  2⤵
  PID:2028
- C:\Users\Admin\AppData\Local\Temp\a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe
  "{path}"
  2⤵
  PID:1180

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1148-54-0x00000000001A0000-0x000000000045C000-memory.dmp

Filesize
2.7MB

Download
memory/1148-55-0x0000000004FC0000-0x0000000005000000-memory.dmp

Filesize
256KB

Download
memory/1148-56-0x00000000005D0000-0x00000000005E4000-memory.dmp

Filesize
80KB

Download
memory/1148-57-0x0000000004FC0000-0x0000000005000000-memory.dmp

Filesize
256KB

Download
memory/1148-58-0x0000000009640000-0x000000000987A000-memory.dmp

Filesize
2.2MB

Download
memory/1148-59-0x000000000D1B0000-0x000000000D5C2000-memory.dmp

Filesize
4.1MB

Download