Analysis
-
max time kernel
117s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
29/10/2023, 11:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20231023-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
tmp.exe
-
Size
428KB
-
MD5
483d71b482d37c5b805f98b11d8fc20f
-
SHA1
201639df817aa041f40bcc6411c6faaf00c1a7c4
-
SHA256
8fc6d1d2d1d833f83a1bfc9656e1c1b5cfb01df873fb583dd046c3de9703427f
-
SHA512
5ee17eff9c72d5636dde03acabea1df57e6e8609a9240d916e65edc5b95b89095118892d3135454da76bff390933dbebc591734d3971501674db4c08e2ffc7c8
-
SSDEEP
12288:T1EeXNhsrBTcyvImbSmSg6bVChl86M74gvktLLmF:T5yvImW0gvktLLm
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2672 WMIC.exe Token: SeSecurityPrivilege 2672 WMIC.exe Token: SeTakeOwnershipPrivilege 2672 WMIC.exe Token: SeLoadDriverPrivilege 2672 WMIC.exe Token: SeSystemProfilePrivilege 2672 WMIC.exe Token: SeSystemtimePrivilege 2672 WMIC.exe Token: SeProfSingleProcessPrivilege 2672 WMIC.exe Token: SeIncBasePriorityPrivilege 2672 WMIC.exe Token: SeCreatePagefilePrivilege 2672 WMIC.exe Token: SeBackupPrivilege 2672 WMIC.exe Token: SeRestorePrivilege 2672 WMIC.exe Token: SeShutdownPrivilege 2672 WMIC.exe Token: SeDebugPrivilege 2672 WMIC.exe Token: SeSystemEnvironmentPrivilege 2672 WMIC.exe Token: SeRemoteShutdownPrivilege 2672 WMIC.exe Token: SeUndockPrivilege 2672 WMIC.exe Token: SeManageVolumePrivilege 2672 WMIC.exe Token: 33 2672 WMIC.exe Token: 34 2672 WMIC.exe Token: 35 2672 WMIC.exe Token: SeIncreaseQuotaPrivilege 2672 WMIC.exe Token: SeSecurityPrivilege 2672 WMIC.exe Token: SeTakeOwnershipPrivilege 2672 WMIC.exe Token: SeLoadDriverPrivilege 2672 WMIC.exe Token: SeSystemProfilePrivilege 2672 WMIC.exe Token: SeSystemtimePrivilege 2672 WMIC.exe Token: SeProfSingleProcessPrivilege 2672 WMIC.exe Token: SeIncBasePriorityPrivilege 2672 WMIC.exe Token: SeCreatePagefilePrivilege 2672 WMIC.exe Token: SeBackupPrivilege 2672 WMIC.exe Token: SeRestorePrivilege 2672 WMIC.exe Token: SeShutdownPrivilege 2672 WMIC.exe Token: SeDebugPrivilege 2672 WMIC.exe Token: SeSystemEnvironmentPrivilege 2672 WMIC.exe Token: SeRemoteShutdownPrivilege 2672 WMIC.exe Token: SeUndockPrivilege 2672 WMIC.exe Token: SeManageVolumePrivilege 2672 WMIC.exe Token: 33 2672 WMIC.exe Token: 34 2672 WMIC.exe Token: 35 2672 WMIC.exe Token: SeIncreaseQuotaPrivilege 2432 WMIC.exe Token: SeSecurityPrivilege 2432 WMIC.exe Token: SeTakeOwnershipPrivilege 2432 WMIC.exe Token: SeLoadDriverPrivilege 2432 WMIC.exe Token: SeSystemProfilePrivilege 2432 WMIC.exe Token: SeSystemtimePrivilege 2432 WMIC.exe Token: SeProfSingleProcessPrivilege 2432 WMIC.exe Token: SeIncBasePriorityPrivilege 2432 WMIC.exe Token: SeCreatePagefilePrivilege 2432 WMIC.exe Token: SeBackupPrivilege 2432 WMIC.exe Token: SeRestorePrivilege 2432 WMIC.exe Token: SeShutdownPrivilege 2432 WMIC.exe Token: SeDebugPrivilege 2432 WMIC.exe Token: SeSystemEnvironmentPrivilege 2432 WMIC.exe Token: SeRemoteShutdownPrivilege 2432 WMIC.exe Token: SeUndockPrivilege 2432 WMIC.exe Token: SeManageVolumePrivilege 2432 WMIC.exe Token: 33 2432 WMIC.exe Token: 34 2432 WMIC.exe Token: 35 2432 WMIC.exe Token: SeIncreaseQuotaPrivilege 2432 WMIC.exe Token: SeSecurityPrivilege 2432 WMIC.exe Token: SeTakeOwnershipPrivilege 2432 WMIC.exe Token: SeLoadDriverPrivilege 2432 WMIC.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3068 tmp.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 3068 wrote to memory of 2340 3068 tmp.exe 29 PID 3068 wrote to memory of 2340 3068 tmp.exe 29 PID 3068 wrote to memory of 2340 3068 tmp.exe 29 PID 3068 wrote to memory of 2340 3068 tmp.exe 29 PID 2340 wrote to memory of 2672 2340 cmd.exe 31 PID 2340 wrote to memory of 2672 2340 cmd.exe 31 PID 2340 wrote to memory of 2672 2340 cmd.exe 31 PID 2340 wrote to memory of 2672 2340 cmd.exe 31 PID 3068 wrote to memory of 2512 3068 tmp.exe 33 PID 3068 wrote to memory of 2512 3068 tmp.exe 33 PID 3068 wrote to memory of 2512 3068 tmp.exe 33 PID 3068 wrote to memory of 2512 3068 tmp.exe 33 PID 3068 wrote to memory of 2556 3068 tmp.exe 35 PID 3068 wrote to memory of 2556 3068 tmp.exe 35 PID 3068 wrote to memory of 2556 3068 tmp.exe 35 PID 3068 wrote to memory of 2556 3068 tmp.exe 35 PID 2556 wrote to memory of 2432 2556 cmd.exe 37 PID 2556 wrote to memory of 2432 2556 cmd.exe 37 PID 2556 wrote to memory of 2432 2556 cmd.exe 37 PID 2556 wrote to memory of 2432 2556 cmd.exe 37 PID 3068 wrote to memory of 3016 3068 tmp.exe 38 PID 3068 wrote to memory of 3016 3068 tmp.exe 38 PID 3068 wrote to memory of 3016 3068 tmp.exe 38 PID 3068 wrote to memory of 3016 3068 tmp.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\cmd.execmd /c wmic csproduct get UUID > C:\uid.txt2⤵
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic csproduct get UUID3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2672
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c del C:\uid.txt2⤵PID:2512
-
-
C:\Windows\SysWOW64\cmd.execmd /c wmic cpu get processorid > C:\cpuid.txt2⤵
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get processorid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2432
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c del C:\cpuid.txt2⤵PID:3016
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82B
MD568c7390ea731dd5f829e2adfbdf23295
SHA1c82bd440ad3250310f203f12033ce12649f4da87
SHA2567737b74a99e724453ae3f690ebaebe9fde866d44dd25b3560f00f50e7445c080
SHA512ff8386d8aa50ad3d90c8eea824e4ca407d1bac7df5fba44a0886f4d75375b7361ca53da369b9781256fd33b032b32547d8234bab67b9cfae56cf4fbbddc8d1d4
-
Filesize
162B
MD59d9362fca70310015cd0561d9a9deafc
SHA131d83515b7d090a6602e541976086938e5769cc6
SHA256f78de8ee7109fd3970aa6c014eb01717c55a78c57c7bf1f7a5b898afb13bb13b
SHA512161790306e40b5b7e957b764b679869ab2d8e104cf8c38321fe4eed98f201a5ca7c168ab59beeddd167257e99958a27011ab6b04cba3f67276544186b3103355