0e362e064fca6127dff2f0b52d55343494ed661e54aafad7ee923545974ec2e1

Analysis

max time kernel
119s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 19:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f1d580624cc7159b639bb65686efbba.exe
Size

932KB
MD5

0f1d580624cc7159b639bb65686efbba
SHA1

53415dcbf70f15094af36a3694579b8027019310
SHA256

0e362e064fca6127dff2f0b52d55343494ed661e54aafad7ee923545974ec2e1
SHA512

01f349e40fb7e8ca9ef874cfdb48c776f17760618dbbc37d756e4e9dbb446d55e0fbad5c8848fa5845341a916b3f4ad0f30be9197505a80ea35b7afdc7de98f7
SSDEEP

12288:TfMa+NXT+Nl+NeE+N3E+NB9E+NIE+N6+Nh+N/+Nh+NQ+NE+NX+Nv+Ny+NX+NZ+NL:4VWrh3LXkuE67Ee8/RjP4T

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2328	0f1d580624cc7159b639bb65686efbba.exe
2328	0f1d580624cc7159b639bb65686efbba.exe
2328	0f1d580624cc7159b639bb65686efbba.exe
2328	0f1d580624cc7159b639bb65686efbba.exe
2328	0f1d580624cc7159b639bb65686efbba.exe
2328	0f1d580624cc7159b639bb65686efbba.exe
2328	0f1d580624cc7159b639bb65686efbba.exe
2328	0f1d580624cc7159b639bb65686efbba.exe
2328	0f1d580624cc7159b639bb65686efbba.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2328	0f1d580624cc7159b639bb65686efbba.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 2784	2328	0f1d580624cc7159b639bb65686efbba.exe	29
PID 2328 wrote to memory of 2784	2328	0f1d580624cc7159b639bb65686efbba.exe	29
PID 2328 wrote to memory of 2784	2328	0f1d580624cc7159b639bb65686efbba.exe	29
PID 2328 wrote to memory of 2784	2328	0f1d580624cc7159b639bb65686efbba.exe	29
PID 2328 wrote to memory of 2800	2328	0f1d580624cc7159b639bb65686efbba.exe	30
PID 2328 wrote to memory of 2800	2328	0f1d580624cc7159b639bb65686efbba.exe	30
PID 2328 wrote to memory of 2800	2328	0f1d580624cc7159b639bb65686efbba.exe	30
PID 2328 wrote to memory of 2800	2328	0f1d580624cc7159b639bb65686efbba.exe	30
PID 2328 wrote to memory of 2804	2328	0f1d580624cc7159b639bb65686efbba.exe	31
PID 2328 wrote to memory of 2804	2328	0f1d580624cc7159b639bb65686efbba.exe	31
PID 2328 wrote to memory of 2804	2328	0f1d580624cc7159b639bb65686efbba.exe	31
PID 2328 wrote to memory of 2804	2328	0f1d580624cc7159b639bb65686efbba.exe	31
PID 2328 wrote to memory of 2812	2328	0f1d580624cc7159b639bb65686efbba.exe	32
PID 2328 wrote to memory of 2812	2328	0f1d580624cc7159b639bb65686efbba.exe	32
PID 2328 wrote to memory of 2812	2328	0f1d580624cc7159b639bb65686efbba.exe	32
PID 2328 wrote to memory of 2812	2328	0f1d580624cc7159b639bb65686efbba.exe	32
PID 2328 wrote to memory of 2852	2328	0f1d580624cc7159b639bb65686efbba.exe	33
PID 2328 wrote to memory of 2852	2328	0f1d580624cc7159b639bb65686efbba.exe	33
PID 2328 wrote to memory of 2852	2328	0f1d580624cc7159b639bb65686efbba.exe	33
PID 2328 wrote to memory of 2852	2328	0f1d580624cc7159b639bb65686efbba.exe	33

C:\Users\Admin\AppData\Local\Temp\0f1d580624cc7159b639bb65686efbba.exe
"C:\Users\Admin\AppData\Local\Temp\0f1d580624cc7159b639bb65686efbba.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Users\Admin\AppData\Local\Temp\0f1d580624cc7159b639bb65686efbba.exe
  "C:\Users\Admin\AppData\Local\Temp\0f1d580624cc7159b639bb65686efbba.exe"
  2⤵
  PID:2784
- C:\Users\Admin\AppData\Local\Temp\0f1d580624cc7159b639bb65686efbba.exe
  "C:\Users\Admin\AppData\Local\Temp\0f1d580624cc7159b639bb65686efbba.exe"
  2⤵
  PID:2800
- C:\Users\Admin\AppData\Local\Temp\0f1d580624cc7159b639bb65686efbba.exe
  "C:\Users\Admin\AppData\Local\Temp\0f1d580624cc7159b639bb65686efbba.exe"
  2⤵
  PID:2804
- C:\Users\Admin\AppData\Local\Temp\0f1d580624cc7159b639bb65686efbba.exe
  "C:\Users\Admin\AppData\Local\Temp\0f1d580624cc7159b639bb65686efbba.exe"
  2⤵
  PID:2812
- C:\Users\Admin\AppData\Local\Temp\0f1d580624cc7159b639bb65686efbba.exe
  "C:\Users\Admin\AppData\Local\Temp\0f1d580624cc7159b639bb65686efbba.exe"
  2⤵
  PID:2852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2328-0-0x0000000000360000-0x000000000044E000-memory.dmp

Filesize
952KB

Download
memory/2328-1-0x00000000740E0000-0x00000000747CE000-memory.dmp

Filesize
6.9MB

Download
memory/2328-2-0x0000000004AD0000-0x0000000004B10000-memory.dmp

Filesize
256KB

Download
memory/2328-3-0x0000000001E50000-0x0000000001E98000-memory.dmp

Filesize
288KB

Download
memory/2328-4-0x00000000740E0000-0x00000000747CE000-memory.dmp

Filesize
6.9MB

Download