Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
19-12-2023 19:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
88679797aff29f111d110ccc9cc9fd2c.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
88679797aff29f111d110ccc9cc9fd2c.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
88679797aff29f111d110ccc9cc9fd2c.exe
-
Size
1.9MB
-
MD5
88679797aff29f111d110ccc9cc9fd2c
-
SHA1
adde4a3e6631aa0f82e5b0bf6bd8b917d78bad63
-
SHA256
971dea6d176bb8bdae2c6570bbdee5fd41c447c6cbb79a8643c76991c8f988aa
-
SHA512
65eec81dcb0c0e92f528031fbf619b656e9b2856a02190cbb9c57c38e785f3c2bac713297392c590f6b1136e5343424db869e1ed2c63799c41975018e7c1b548
-
SSDEEP
49152:nzzs3PnDN+gqsJjvpcIJKbahPEwbzN6pt:03p+7Wp9hPEwnNm
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
88679797aff29f111d110ccc9cc9fd2c.exepid process 2668 88679797aff29f111d110ccc9cc9fd2c.exe 2668 88679797aff29f111d110ccc9cc9fd2c.exe 2668 88679797aff29f111d110ccc9cc9fd2c.exe 2668 88679797aff29f111d110ccc9cc9fd2c.exe 2668 88679797aff29f111d110ccc9cc9fd2c.exe 2668 88679797aff29f111d110ccc9cc9fd2c.exe 2668 88679797aff29f111d110ccc9cc9fd2c.exe 2668 88679797aff29f111d110ccc9cc9fd2c.exe 2668 88679797aff29f111d110ccc9cc9fd2c.exe 2668 88679797aff29f111d110ccc9cc9fd2c.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
88679797aff29f111d110ccc9cc9fd2c.exedescription pid process Token: SeDebugPrivilege 2668 88679797aff29f111d110ccc9cc9fd2c.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
88679797aff29f111d110ccc9cc9fd2c.exedescription pid process target process PID 2668 wrote to memory of 2600 2668 88679797aff29f111d110ccc9cc9fd2c.exe 88679797aff29f111d110ccc9cc9fd2c.exe PID 2668 wrote to memory of 2600 2668 88679797aff29f111d110ccc9cc9fd2c.exe 88679797aff29f111d110ccc9cc9fd2c.exe PID 2668 wrote to memory of 2600 2668 88679797aff29f111d110ccc9cc9fd2c.exe 88679797aff29f111d110ccc9cc9fd2c.exe PID 2668 wrote to memory of 2600 2668 88679797aff29f111d110ccc9cc9fd2c.exe 88679797aff29f111d110ccc9cc9fd2c.exe PID 2668 wrote to memory of 2616 2668 88679797aff29f111d110ccc9cc9fd2c.exe 88679797aff29f111d110ccc9cc9fd2c.exe PID 2668 wrote to memory of 2616 2668 88679797aff29f111d110ccc9cc9fd2c.exe 88679797aff29f111d110ccc9cc9fd2c.exe PID 2668 wrote to memory of 2616 2668 88679797aff29f111d110ccc9cc9fd2c.exe 88679797aff29f111d110ccc9cc9fd2c.exe PID 2668 wrote to memory of 2616 2668 88679797aff29f111d110ccc9cc9fd2c.exe 88679797aff29f111d110ccc9cc9fd2c.exe PID 2668 wrote to memory of 2640 2668 88679797aff29f111d110ccc9cc9fd2c.exe 88679797aff29f111d110ccc9cc9fd2c.exe PID 2668 wrote to memory of 2640 2668 88679797aff29f111d110ccc9cc9fd2c.exe 88679797aff29f111d110ccc9cc9fd2c.exe PID 2668 wrote to memory of 2640 2668 88679797aff29f111d110ccc9cc9fd2c.exe 88679797aff29f111d110ccc9cc9fd2c.exe PID 2668 wrote to memory of 2640 2668 88679797aff29f111d110ccc9cc9fd2c.exe 88679797aff29f111d110ccc9cc9fd2c.exe PID 2668 wrote to memory of 2656 2668 88679797aff29f111d110ccc9cc9fd2c.exe 88679797aff29f111d110ccc9cc9fd2c.exe PID 2668 wrote to memory of 2656 2668 88679797aff29f111d110ccc9cc9fd2c.exe 88679797aff29f111d110ccc9cc9fd2c.exe PID 2668 wrote to memory of 2656 2668 88679797aff29f111d110ccc9cc9fd2c.exe 88679797aff29f111d110ccc9cc9fd2c.exe PID 2668 wrote to memory of 2656 2668 88679797aff29f111d110ccc9cc9fd2c.exe 88679797aff29f111d110ccc9cc9fd2c.exe PID 2668 wrote to memory of 2708 2668 88679797aff29f111d110ccc9cc9fd2c.exe 88679797aff29f111d110ccc9cc9fd2c.exe PID 2668 wrote to memory of 2708 2668 88679797aff29f111d110ccc9cc9fd2c.exe 88679797aff29f111d110ccc9cc9fd2c.exe PID 2668 wrote to memory of 2708 2668 88679797aff29f111d110ccc9cc9fd2c.exe 88679797aff29f111d110ccc9cc9fd2c.exe PID 2668 wrote to memory of 2708 2668 88679797aff29f111d110ccc9cc9fd2c.exe 88679797aff29f111d110ccc9cc9fd2c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\88679797aff29f111d110ccc9cc9fd2c.exe"C:\Users\Admin\AppData\Local\Temp\88679797aff29f111d110ccc9cc9fd2c.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\88679797aff29f111d110ccc9cc9fd2c.exe"C:\Users\Admin\AppData\Local\Temp\88679797aff29f111d110ccc9cc9fd2c.exe"2⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\88679797aff29f111d110ccc9cc9fd2c.exe"C:\Users\Admin\AppData\Local\Temp\88679797aff29f111d110ccc9cc9fd2c.exe"2⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\88679797aff29f111d110ccc9cc9fd2c.exe"C:\Users\Admin\AppData\Local\Temp\88679797aff29f111d110ccc9cc9fd2c.exe"2⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\88679797aff29f111d110ccc9cc9fd2c.exe"C:\Users\Admin\AppData\Local\Temp\88679797aff29f111d110ccc9cc9fd2c.exe"2⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\88679797aff29f111d110ccc9cc9fd2c.exe"C:\Users\Admin\AppData\Local\Temp\88679797aff29f111d110ccc9cc9fd2c.exe"2⤵PID:2708
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2668-0-0x0000000074C70000-0x000000007535E000-memory.dmpFilesize
6.9MB
-
memory/2668-1-0x0000000000270000-0x000000000045E000-memory.dmpFilesize
1.9MB
-
memory/2668-2-0x0000000004DD0000-0x0000000004E10000-memory.dmpFilesize
256KB
-
memory/2668-3-0x00000000004B0000-0x00000000004C2000-memory.dmpFilesize
72KB
-
memory/2668-4-0x0000000074C70000-0x000000007535E000-memory.dmpFilesize
6.9MB
-
memory/2668-5-0x0000000004DD0000-0x0000000004E10000-memory.dmpFilesize
256KB
-
memory/2668-6-0x0000000005CA0000-0x0000000005E3C000-memory.dmpFilesize
1.6MB
-
memory/2668-7-0x0000000074C70000-0x000000007535E000-memory.dmpFilesize
6.9MB