a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
28-05-2023 04:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe
Size

2.7MB
MD5

e7bf9f0c2c1977ddd8e139c13c27be0d
SHA1

e91aff3d9a8c7cef0e9543350864971e4ad93f82
SHA256

a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba
SHA512

d9961824b178944aec2411c1bb29a5ef4b487ce0c251fe381e2841c6abe00f29ecf895ab1baf93e49442af07a14acdcf9d882519d39beb5c4d4902db2db2560f
SSDEEP

49152:552sxwTr/VsoJteujcnqNwelN/z52r7zj9n0cqv/3SYd:55jxa3JteujcncNNQzj9hqXCY

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
932	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe
932	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe
932	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe
932	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe
932	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	932	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 932 wrote to memory of 464	932	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	28
PID 932 wrote to memory of 464	932	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	28
PID 932 wrote to memory of 464	932	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	28
PID 932 wrote to memory of 464	932	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	28
PID 932 wrote to memory of 524	932	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	29
PID 932 wrote to memory of 524	932	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	29
PID 932 wrote to memory of 524	932	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	29
PID 932 wrote to memory of 524	932	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	29
PID 932 wrote to memory of 436	932	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	30
PID 932 wrote to memory of 436	932	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	30
PID 932 wrote to memory of 436	932	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	30
PID 932 wrote to memory of 436	932	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	30
PID 932 wrote to memory of 1384	932	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	31
PID 932 wrote to memory of 1384	932	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	31
PID 932 wrote to memory of 1384	932	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	31
PID 932 wrote to memory of 1384	932	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	31
PID 932 wrote to memory of 672	932	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	32
PID 932 wrote to memory of 672	932	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	32
PID 932 wrote to memory of 672	932	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	32
PID 932 wrote to memory of 672	932	a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe	32

C:\Users\Admin\AppData\Local\Temp\a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe
"C:\Users\Admin\AppData\Local\Temp\a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:932
- C:\Users\Admin\AppData\Local\Temp\a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe
  "{path}"
  2⤵
  PID:464
- C:\Users\Admin\AppData\Local\Temp\a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe
  "{path}"
  2⤵
  PID:524
- C:\Users\Admin\AppData\Local\Temp\a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe
  "{path}"
  2⤵
  PID:436
- C:\Users\Admin\AppData\Local\Temp\a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe
  "{path}"
  2⤵
  PID:1384
- C:\Users\Admin\AppData\Local\Temp\a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba.exe
  "{path}"
  2⤵
  PID:672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/932-54-0x00000000001A0000-0x000000000045C000-memory.dmp

Filesize
2.7MB

Download
memory/932-55-0x0000000002210000-0x0000000002250000-memory.dmp

Filesize
256KB

Download
memory/932-56-0x0000000000700000-0x0000000000714000-memory.dmp

Filesize
80KB

Download
memory/932-57-0x0000000002210000-0x0000000002250000-memory.dmp

Filesize
256KB

Download
memory/932-58-0x0000000009290000-0x00000000094CA000-memory.dmp

Filesize
2.2MB

Download
memory/932-59-0x000000000C8B0000-0x000000000CCC2000-memory.dmp

Filesize
4.1MB

Download