a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba

Analysis

max time kernel
32s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
24-05-2023 04:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe
Size

2.7MB
MD5

e7bf9f0c2c1977ddd8e139c13c27be0d
SHA1

e91aff3d9a8c7cef0e9543350864971e4ad93f82
SHA256

a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba
SHA512

d9961824b178944aec2411c1bb29a5ef4b487ce0c251fe381e2841c6abe00f29ecf895ab1baf93e49442af07a14acdcf9d882519d39beb5c4d4902db2db2560f
SSDEEP

49152:552sxwTr/VsoJteujcnqNwelN/z52r7zj9n0cqv/3SYd:55jxa3JteujcncNNQzj9hqXCY

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1216	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe
1216	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe
1216	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe
1216	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe
1216	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1216	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 296	1216	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	28
PID 1216 wrote to memory of 296	1216	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	28
PID 1216 wrote to memory of 296	1216	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	28
PID 1216 wrote to memory of 296	1216	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	28
PID 1216 wrote to memory of 732	1216	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	29
PID 1216 wrote to memory of 732	1216	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	29
PID 1216 wrote to memory of 732	1216	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	29
PID 1216 wrote to memory of 732	1216	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	29
PID 1216 wrote to memory of 780	1216	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	30
PID 1216 wrote to memory of 780	1216	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	30
PID 1216 wrote to memory of 780	1216	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	30
PID 1216 wrote to memory of 780	1216	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	30
PID 1216 wrote to memory of 684	1216	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	31
PID 1216 wrote to memory of 684	1216	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	31
PID 1216 wrote to memory of 684	1216	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	31
PID 1216 wrote to memory of 684	1216	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	31
PID 1216 wrote to memory of 1288	1216	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	32
PID 1216 wrote to memory of 1288	1216	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	32
PID 1216 wrote to memory of 1288	1216	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	32
PID 1216 wrote to memory of 1288	1216	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	32

C:\Users\Admin\AppData\Local\Temp\a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe
"C:\Users\Admin\AppData\Local\Temp\a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Users\Admin\AppData\Local\Temp\a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe
  "{path}"
  2⤵
  PID:296
- C:\Users\Admin\AppData\Local\Temp\a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe
  "{path}"
  2⤵
  PID:732
- C:\Users\Admin\AppData\Local\Temp\a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe
  "{path}"
  2⤵
  PID:780
- C:\Users\Admin\AppData\Local\Temp\a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe
  "{path}"
  2⤵
  PID:684
- C:\Users\Admin\AppData\Local\Temp\a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe
  "{path}"
  2⤵
  PID:1288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1216-54-0x0000000000200000-0x00000000004BC000-memory.dmp

Filesize
2.7MB

Download
memory/1216-55-0x0000000005040000-0x0000000005080000-memory.dmp

Filesize
256KB

Download
memory/1216-56-0x0000000000520000-0x0000000000534000-memory.dmp

Filesize
80KB

Download
memory/1216-57-0x0000000005040000-0x0000000005080000-memory.dmp

Filesize
256KB

Download
memory/1216-58-0x00000000094C0000-0x00000000096FA000-memory.dmp

Filesize
2.2MB

Download
memory/1216-59-0x000000000CE40000-0x000000000D252000-memory.dmp

Filesize
4.1MB

Download