Analysis

  • max time kernel
    120s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    13-10-2023 13:15

General

  • Target

    a983acd5ea7e9fb1eb2ed57f6e9393615659c5c048d39fbd8b649511f823a894.exe

  • Size

    3.9MB

  • MD5

    e0f5e8b2c0368e6e4634b50a461c46f4

  • SHA1

    9d14972d61544181837feafda360baa07eb73e9f

  • SHA256

    a983acd5ea7e9fb1eb2ed57f6e9393615659c5c048d39fbd8b649511f823a894

  • SHA512

    e3d839fadb917454e308578e9b2d8c6a4c137656f357cbbfa02804773ea7f80b0105199f2d05f78cc2c7cba6d5ca140c05de833df6a163facae15c83758780b5

  • SSDEEP

    49152:hSdjhZypyvZOXSyb6qLS7Ex/+0tPpQbwRhd85I8DvMtYEeTat:55jtmkhU88Tat

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a983acd5ea7e9fb1eb2ed57f6e9393615659c5c048d39fbd8b649511f823a894.exe
    "C:\Users\Admin\AppData\Local\Temp\a983acd5ea7e9fb1eb2ed57f6e9393615659c5c048d39fbd8b649511f823a894.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2952
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -ExecutionPolicy Bypass -File wei-close.ps1 qbittorrent
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\wei\status.dat
    Filesize

    12B

    MD5

    ac963522636ece1161192ea4985e9ef6

    SHA1

    9a4309a5e05e38038ff659fc46917d497327291f

    SHA256

    5fabc2d9e049aaf03fb8eb337fe37ddbbca16a754d8534ea4697b6ede858a311

    SHA512

    a6698dc7d7c35fb64007d107654e411c225a7f24bc2e3ba60be9521ff92506199ce0fdfb698922e304c12d56ca18197d609fbc021313883c6d8f7a2a936d62e4

  • memory/1636-15-0x000000001B2E0000-0x000000001B5C2000-memory.dmp
    Filesize

    2.9MB

  • memory/1636-17-0x000007FEF59F0000-0x000007FEF638D000-memory.dmp
    Filesize

    9.6MB

  • memory/1636-19-0x000007FEF59F0000-0x000007FEF638D000-memory.dmp
    Filesize

    9.6MB

  • memory/1636-20-0x000007FEF59F0000-0x000007FEF638D000-memory.dmp
    Filesize

    9.6MB

  • memory/1636-18-0x00000000029F4000-0x00000000029F7000-memory.dmp
    Filesize

    12KB

  • memory/1636-16-0x0000000001FC0000-0x0000000001FC8000-memory.dmp
    Filesize

    32KB