7cbf7de49360ae52ac635826eb6ce774decfa3f3e9de7dc36aff15ffb3ad09f0

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 14:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

252dab582ba82d02f0a5481c51275928.exe
Size

103KB
MD5

252dab582ba82d02f0a5481c51275928
SHA1

a71691c4976deb46835a522b047ff741971556ae
SHA256

7cbf7de49360ae52ac635826eb6ce774decfa3f3e9de7dc36aff15ffb3ad09f0
SHA512

3de5e13a78c31290c03991c6cb81c4a5080cf93db819cade01b4b027710cccc9338e74150532eccb52233157fd6322f428a108d68b7901db696516c0b11e04e3
SSDEEP

3072:cZnz7D5/Av8k9ezddASlX894zCC7TL8Lhqib:cnz1g39edW+Y4zz9ib

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2316	252dab582ba82d02f0a5481c51275928.exe

Suspicious behavior: MapViewOfSection 21 IoCs

pid	Process
2316	252dab582ba82d02f0a5481c51275928.exe
2316	252dab582ba82d02f0a5481c51275928.exe
2316	252dab582ba82d02f0a5481c51275928.exe
2316	252dab582ba82d02f0a5481c51275928.exe
2316	252dab582ba82d02f0a5481c51275928.exe
2316	252dab582ba82d02f0a5481c51275928.exe
2316	252dab582ba82d02f0a5481c51275928.exe
2316	252dab582ba82d02f0a5481c51275928.exe
2316	252dab582ba82d02f0a5481c51275928.exe
2316	252dab582ba82d02f0a5481c51275928.exe
2316	252dab582ba82d02f0a5481c51275928.exe
2316	252dab582ba82d02f0a5481c51275928.exe
2316	252dab582ba82d02f0a5481c51275928.exe
2316	252dab582ba82d02f0a5481c51275928.exe
2316	252dab582ba82d02f0a5481c51275928.exe
2316	252dab582ba82d02f0a5481c51275928.exe
2316	252dab582ba82d02f0a5481c51275928.exe
2316	252dab582ba82d02f0a5481c51275928.exe
2316	252dab582ba82d02f0a5481c51275928.exe
2316	252dab582ba82d02f0a5481c51275928.exe
2316	252dab582ba82d02f0a5481c51275928.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2316	252dab582ba82d02f0a5481c51275928.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 372	2316	252dab582ba82d02f0a5481c51275928.exe	4
PID 2316 wrote to memory of 372	2316	252dab582ba82d02f0a5481c51275928.exe	4
PID 2316 wrote to memory of 372	2316	252dab582ba82d02f0a5481c51275928.exe	4
PID 2316 wrote to memory of 372	2316	252dab582ba82d02f0a5481c51275928.exe	4
PID 2316 wrote to memory of 372	2316	252dab582ba82d02f0a5481c51275928.exe	4
PID 2316 wrote to memory of 372	2316	252dab582ba82d02f0a5481c51275928.exe	4
PID 2316 wrote to memory of 372	2316	252dab582ba82d02f0a5481c51275928.exe	4
PID 2316 wrote to memory of 384	2316	252dab582ba82d02f0a5481c51275928.exe	3
PID 2316 wrote to memory of 384	2316	252dab582ba82d02f0a5481c51275928.exe	3
PID 2316 wrote to memory of 384	2316	252dab582ba82d02f0a5481c51275928.exe	3
PID 2316 wrote to memory of 384	2316	252dab582ba82d02f0a5481c51275928.exe	3
PID 2316 wrote to memory of 384	2316	252dab582ba82d02f0a5481c51275928.exe	3
PID 2316 wrote to memory of 384	2316	252dab582ba82d02f0a5481c51275928.exe	3
PID 2316 wrote to memory of 384	2316	252dab582ba82d02f0a5481c51275928.exe	3
PID 2316 wrote to memory of 420	2316	252dab582ba82d02f0a5481c51275928.exe	2
PID 2316 wrote to memory of 420	2316	252dab582ba82d02f0a5481c51275928.exe	2
PID 2316 wrote to memory of 420	2316	252dab582ba82d02f0a5481c51275928.exe	2
PID 2316 wrote to memory of 420	2316	252dab582ba82d02f0a5481c51275928.exe	2
PID 2316 wrote to memory of 420	2316	252dab582ba82d02f0a5481c51275928.exe	2
PID 2316 wrote to memory of 420	2316	252dab582ba82d02f0a5481c51275928.exe	2
PID 2316 wrote to memory of 420	2316	252dab582ba82d02f0a5481c51275928.exe	2
PID 2316 wrote to memory of 468	2316	252dab582ba82d02f0a5481c51275928.exe	1
PID 2316 wrote to memory of 468	2316	252dab582ba82d02f0a5481c51275928.exe	1
PID 2316 wrote to memory of 468	2316	252dab582ba82d02f0a5481c51275928.exe	1
PID 2316 wrote to memory of 468	2316	252dab582ba82d02f0a5481c51275928.exe	1
PID 2316 wrote to memory of 468	2316	252dab582ba82d02f0a5481c51275928.exe	1
PID 2316 wrote to memory of 468	2316	252dab582ba82d02f0a5481c51275928.exe	1
PID 2316 wrote to memory of 468	2316	252dab582ba82d02f0a5481c51275928.exe	1
PID 2316 wrote to memory of 476	2316	252dab582ba82d02f0a5481c51275928.exe	7
PID 2316 wrote to memory of 476	2316	252dab582ba82d02f0a5481c51275928.exe	7
PID 2316 wrote to memory of 476	2316	252dab582ba82d02f0a5481c51275928.exe	7
PID 2316 wrote to memory of 476	2316	252dab582ba82d02f0a5481c51275928.exe	7
PID 2316 wrote to memory of 476	2316	252dab582ba82d02f0a5481c51275928.exe	7
PID 2316 wrote to memory of 476	2316	252dab582ba82d02f0a5481c51275928.exe	7
PID 2316 wrote to memory of 476	2316	252dab582ba82d02f0a5481c51275928.exe	7
PID 2316 wrote to memory of 484	2316	252dab582ba82d02f0a5481c51275928.exe	8
PID 2316 wrote to memory of 484	2316	252dab582ba82d02f0a5481c51275928.exe	8
PID 2316 wrote to memory of 484	2316	252dab582ba82d02f0a5481c51275928.exe	8
PID 2316 wrote to memory of 484	2316	252dab582ba82d02f0a5481c51275928.exe	8
PID 2316 wrote to memory of 484	2316	252dab582ba82d02f0a5481c51275928.exe	8
PID 2316 wrote to memory of 484	2316	252dab582ba82d02f0a5481c51275928.exe	8
PID 2316 wrote to memory of 484	2316	252dab582ba82d02f0a5481c51275928.exe	8
PID 2316 wrote to memory of 596	2316	252dab582ba82d02f0a5481c51275928.exe	26
PID 2316 wrote to memory of 596	2316	252dab582ba82d02f0a5481c51275928.exe	26
PID 2316 wrote to memory of 596	2316	252dab582ba82d02f0a5481c51275928.exe	26
PID 2316 wrote to memory of 596	2316	252dab582ba82d02f0a5481c51275928.exe	26
PID 2316 wrote to memory of 596	2316	252dab582ba82d02f0a5481c51275928.exe	26
PID 2316 wrote to memory of 596	2316	252dab582ba82d02f0a5481c51275928.exe	26
PID 2316 wrote to memory of 596	2316	252dab582ba82d02f0a5481c51275928.exe	26
PID 2316 wrote to memory of 672	2316	252dab582ba82d02f0a5481c51275928.exe	25
PID 2316 wrote to memory of 672	2316	252dab582ba82d02f0a5481c51275928.exe	25
PID 2316 wrote to memory of 672	2316	252dab582ba82d02f0a5481c51275928.exe	25
PID 2316 wrote to memory of 672	2316	252dab582ba82d02f0a5481c51275928.exe	25
PID 2316 wrote to memory of 672	2316	252dab582ba82d02f0a5481c51275928.exe	25
PID 2316 wrote to memory of 672	2316	252dab582ba82d02f0a5481c51275928.exe	25
PID 2316 wrote to memory of 672	2316	252dab582ba82d02f0a5481c51275928.exe	25
PID 2316 wrote to memory of 728	2316	252dab582ba82d02f0a5481c51275928.exe	24
PID 2316 wrote to memory of 728	2316	252dab582ba82d02f0a5481c51275928.exe	24
PID 2316 wrote to memory of 728	2316	252dab582ba82d02f0a5481c51275928.exe	24
PID 2316 wrote to memory of 728	2316	252dab582ba82d02f0a5481c51275928.exe	24
PID 2316 wrote to memory of 728	2316	252dab582ba82d02f0a5481c51275928.exe	24
PID 2316 wrote to memory of 728	2316	252dab582ba82d02f0a5481c51275928.exe	24
PID 2316 wrote to memory of 728	2316	252dab582ba82d02f0a5481c51275928.exe	24
PID 2316 wrote to memory of 800	2316	252dab582ba82d02f0a5481c51275928.exe	23

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:468
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:1016
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1028
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1224
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:1736
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:2320
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:240
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:960
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:844
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:800
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:728
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:672
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:596

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:384

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:372
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:476
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:484

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1828

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1380
- C:\Users\Admin\AppData\Local\Temp\252dab582ba82d02f0a5481c51275928.exe
  "C:\Users\Admin\AppData\Local\Temp\252dab582ba82d02f0a5481c51275928.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2316

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2316-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2316-3-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2316-2-0x00000000778A0000-0x00000000778A1000-memory.dmp

Filesize
4KB

Download
memory/2316-1-0x000000007789F000-0x00000000778A0000-memory.dmp

Filesize
4KB

Download