Analysis

  • max time kernel
    118s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    18/08/2023, 15:18

General

  • Target

    d7a133c378e6af60b98144f04c39206f871941f944c04dafaba607f5f77bc997.exe

  • Size

    1.4MB

  • MD5

    9ef1ba6758ea23950360a34b1e4b0bb0

  • SHA1

    45612825204597bb913a0f816bc2e3f2ca47e449

  • SHA256

    d7a133c378e6af60b98144f04c39206f871941f944c04dafaba607f5f77bc997

  • SHA512

    190a469ed4acd8187c02e28b1a77ec05ca23b31703b2bad81fda2254af4d9e7c6169fe48ce0d08b68fba78657dad5152c5d05970341fe3797f0dc4a5de88f7dc

  • SSDEEP

    24576:scvn1hCiZ+8BuR2vDOlLIHzF1/szzpftNfd:scvnPDyR2fT3szz1X1

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d7a133c378e6af60b98144f04c39206f871941f944c04dafaba607f5f77bc997.exe
    "C:\Users\Admin\AppData\Local\Temp\d7a133c378e6af60b98144f04c39206f871941f944c04dafaba607f5f77bc997.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2220
    • C:\Windows\SysWOW64\cmd.exe
      cmd /k cmd < Anyone & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1608
      • C:\Windows\SysWOW64\cmd.exe
        cmd
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2096
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell get-process avastui
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2340

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\949325\Anyone

          Filesize

          14KB

          MD5

          ee82d316318b3bb19e2a1aa13cfde12d

          SHA1

          83ae8b583212041c75c49c11947443c57d99ebc9

          SHA256

          ba1aa96299673031f84d6a589c990e8e4ee97f8755d40aa0caa1837e8c4b1730

          SHA512

          fef62456632d5d8579c174a137ba3eeed537885f41e550505abf90a9ecf60663fb584624343697fda1d0ba43ea200e2c552d495d0df475d61c1e1691da09e88d

        • memory/2220-54-0x00000000001C0000-0x00000000001C1000-memory.dmp

          Filesize

          4KB

        • memory/2220-73-0x0000000000400000-0x0000000000484000-memory.dmp

          Filesize

          528KB

        • memory/2220-74-0x00000000001C0000-0x00000000001C1000-memory.dmp

          Filesize

          4KB

        • memory/2220-83-0x0000000000400000-0x0000000000484000-memory.dmp

          Filesize

          528KB

        • memory/2340-77-0x0000000000550000-0x0000000000590000-memory.dmp

          Filesize

          256KB

        • memory/2340-76-0x0000000073CF0000-0x000000007429B000-memory.dmp

          Filesize

          5.7MB

        • memory/2340-78-0x0000000000550000-0x0000000000590000-memory.dmp

          Filesize

          256KB

        • memory/2340-79-0x0000000000550000-0x0000000000590000-memory.dmp

          Filesize

          256KB

        • memory/2340-80-0x0000000073CF0000-0x000000007429B000-memory.dmp

          Filesize

          5.7MB

        • memory/2340-81-0x0000000073CF0000-0x000000007429B000-memory.dmp

          Filesize

          5.7MB

        • memory/2340-82-0x0000000073CF0000-0x000000007429B000-memory.dmp

          Filesize

          5.7MB

        • memory/2340-75-0x0000000073CF0000-0x000000007429B000-memory.dmp

          Filesize

          5.7MB