16d820624c9f7e1dddbda179f44b55f1b74e81c5de9c6beef7371ee7467f086b

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 18:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00b85d11a092d4f0fb108adb094154c4.exe
Size

128KB
MD5

00b85d11a092d4f0fb108adb094154c4
SHA1

427a6497ba7ff2637ce0a2840115f594b63f0177
SHA256

16d820624c9f7e1dddbda179f44b55f1b74e81c5de9c6beef7371ee7467f086b
SHA512

89291aab451c7c1b7d67e0c26987133d9eddbba7b2c355cefb608582cc7ea992fa73bedcee6021be1a7a916bee1d7260b696aedbd419fd505c4ccd00bf38bfa1
SSDEEP

1536:nkq1M6S6RxTWGpFIMusizMZwnwFRBbwCKSE8rl0zJsuE0Ds:nlS6S6RAGfosizMZEmJz50zJ5E+s

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2928	00b85d11a092d4f0fb108adb094154c4.exe

Suspicious behavior: MapViewOfSection 21 IoCs

pid	Process
2928	00b85d11a092d4f0fb108adb094154c4.exe
2928	00b85d11a092d4f0fb108adb094154c4.exe
2928	00b85d11a092d4f0fb108adb094154c4.exe
2928	00b85d11a092d4f0fb108adb094154c4.exe
2928	00b85d11a092d4f0fb108adb094154c4.exe
2928	00b85d11a092d4f0fb108adb094154c4.exe
2928	00b85d11a092d4f0fb108adb094154c4.exe
2928	00b85d11a092d4f0fb108adb094154c4.exe
2928	00b85d11a092d4f0fb108adb094154c4.exe
2928	00b85d11a092d4f0fb108adb094154c4.exe
2928	00b85d11a092d4f0fb108adb094154c4.exe
2928	00b85d11a092d4f0fb108adb094154c4.exe
2928	00b85d11a092d4f0fb108adb094154c4.exe
2928	00b85d11a092d4f0fb108adb094154c4.exe
2928	00b85d11a092d4f0fb108adb094154c4.exe
2928	00b85d11a092d4f0fb108adb094154c4.exe
2928	00b85d11a092d4f0fb108adb094154c4.exe
2928	00b85d11a092d4f0fb108adb094154c4.exe
2928	00b85d11a092d4f0fb108adb094154c4.exe
2928	00b85d11a092d4f0fb108adb094154c4.exe
2928	00b85d11a092d4f0fb108adb094154c4.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2928	00b85d11a092d4f0fb108adb094154c4.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 384	2928	00b85d11a092d4f0fb108adb094154c4.exe	5
PID 2928 wrote to memory of 384	2928	00b85d11a092d4f0fb108adb094154c4.exe	5
PID 2928 wrote to memory of 384	2928	00b85d11a092d4f0fb108adb094154c4.exe	5
PID 2928 wrote to memory of 384	2928	00b85d11a092d4f0fb108adb094154c4.exe	5
PID 2928 wrote to memory of 384	2928	00b85d11a092d4f0fb108adb094154c4.exe	5
PID 2928 wrote to memory of 396	2928	00b85d11a092d4f0fb108adb094154c4.exe	4
PID 2928 wrote to memory of 396	2928	00b85d11a092d4f0fb108adb094154c4.exe	4
PID 2928 wrote to memory of 396	2928	00b85d11a092d4f0fb108adb094154c4.exe	4
PID 2928 wrote to memory of 396	2928	00b85d11a092d4f0fb108adb094154c4.exe	4
PID 2928 wrote to memory of 396	2928	00b85d11a092d4f0fb108adb094154c4.exe	4
PID 2928 wrote to memory of 432	2928	00b85d11a092d4f0fb108adb094154c4.exe	3
PID 2928 wrote to memory of 432	2928	00b85d11a092d4f0fb108adb094154c4.exe	3
PID 2928 wrote to memory of 432	2928	00b85d11a092d4f0fb108adb094154c4.exe	3
PID 2928 wrote to memory of 432	2928	00b85d11a092d4f0fb108adb094154c4.exe	3
PID 2928 wrote to memory of 432	2928	00b85d11a092d4f0fb108adb094154c4.exe	3
PID 2928 wrote to memory of 480	2928	00b85d11a092d4f0fb108adb094154c4.exe	2
PID 2928 wrote to memory of 480	2928	00b85d11a092d4f0fb108adb094154c4.exe	2
PID 2928 wrote to memory of 480	2928	00b85d11a092d4f0fb108adb094154c4.exe	2
PID 2928 wrote to memory of 480	2928	00b85d11a092d4f0fb108adb094154c4.exe	2
PID 2928 wrote to memory of 480	2928	00b85d11a092d4f0fb108adb094154c4.exe	2
PID 2928 wrote to memory of 488	2928	00b85d11a092d4f0fb108adb094154c4.exe	1
PID 2928 wrote to memory of 488	2928	00b85d11a092d4f0fb108adb094154c4.exe	1
PID 2928 wrote to memory of 488	2928	00b85d11a092d4f0fb108adb094154c4.exe	1
PID 2928 wrote to memory of 488	2928	00b85d11a092d4f0fb108adb094154c4.exe	1
PID 2928 wrote to memory of 488	2928	00b85d11a092d4f0fb108adb094154c4.exe	1
PID 2928 wrote to memory of 496	2928	00b85d11a092d4f0fb108adb094154c4.exe	8
PID 2928 wrote to memory of 496	2928	00b85d11a092d4f0fb108adb094154c4.exe	8
PID 2928 wrote to memory of 496	2928	00b85d11a092d4f0fb108adb094154c4.exe	8
PID 2928 wrote to memory of 496	2928	00b85d11a092d4f0fb108adb094154c4.exe	8
PID 2928 wrote to memory of 496	2928	00b85d11a092d4f0fb108adb094154c4.exe	8
PID 2928 wrote to memory of 608	2928	00b85d11a092d4f0fb108adb094154c4.exe	27
PID 2928 wrote to memory of 608	2928	00b85d11a092d4f0fb108adb094154c4.exe	27
PID 2928 wrote to memory of 608	2928	00b85d11a092d4f0fb108adb094154c4.exe	27
PID 2928 wrote to memory of 608	2928	00b85d11a092d4f0fb108adb094154c4.exe	27
PID 2928 wrote to memory of 608	2928	00b85d11a092d4f0fb108adb094154c4.exe	27
PID 2928 wrote to memory of 688	2928	00b85d11a092d4f0fb108adb094154c4.exe	26
PID 2928 wrote to memory of 688	2928	00b85d11a092d4f0fb108adb094154c4.exe	26
PID 2928 wrote to memory of 688	2928	00b85d11a092d4f0fb108adb094154c4.exe	26
PID 2928 wrote to memory of 688	2928	00b85d11a092d4f0fb108adb094154c4.exe	26
PID 2928 wrote to memory of 688	2928	00b85d11a092d4f0fb108adb094154c4.exe	26
PID 2928 wrote to memory of 772	2928	00b85d11a092d4f0fb108adb094154c4.exe	25
PID 2928 wrote to memory of 772	2928	00b85d11a092d4f0fb108adb094154c4.exe	25
PID 2928 wrote to memory of 772	2928	00b85d11a092d4f0fb108adb094154c4.exe	25
PID 2928 wrote to memory of 772	2928	00b85d11a092d4f0fb108adb094154c4.exe	25
PID 2928 wrote to memory of 772	2928	00b85d11a092d4f0fb108adb094154c4.exe	25
PID 2928 wrote to memory of 820	2928	00b85d11a092d4f0fb108adb094154c4.exe	24
PID 2928 wrote to memory of 820	2928	00b85d11a092d4f0fb108adb094154c4.exe	24
PID 2928 wrote to memory of 820	2928	00b85d11a092d4f0fb108adb094154c4.exe	24
PID 2928 wrote to memory of 820	2928	00b85d11a092d4f0fb108adb094154c4.exe	24
PID 2928 wrote to memory of 820	2928	00b85d11a092d4f0fb108adb094154c4.exe	24
PID 2928 wrote to memory of 852	2928	00b85d11a092d4f0fb108adb094154c4.exe	9
PID 2928 wrote to memory of 852	2928	00b85d11a092d4f0fb108adb094154c4.exe	9
PID 2928 wrote to memory of 852	2928	00b85d11a092d4f0fb108adb094154c4.exe	9
PID 2928 wrote to memory of 852	2928	00b85d11a092d4f0fb108adb094154c4.exe	9
PID 2928 wrote to memory of 852	2928	00b85d11a092d4f0fb108adb094154c4.exe	9
PID 2928 wrote to memory of 988	2928	00b85d11a092d4f0fb108adb094154c4.exe	22
PID 2928 wrote to memory of 988	2928	00b85d11a092d4f0fb108adb094154c4.exe	22
PID 2928 wrote to memory of 988	2928	00b85d11a092d4f0fb108adb094154c4.exe	22
PID 2928 wrote to memory of 988	2928	00b85d11a092d4f0fb108adb094154c4.exe	22
PID 2928 wrote to memory of 988	2928	00b85d11a092d4f0fb108adb094154c4.exe	22
PID 2928 wrote to memory of 300	2928	00b85d11a092d4f0fb108adb094154c4.exe	21
PID 2928 wrote to memory of 300	2928	00b85d11a092d4f0fb108adb094154c4.exe	21
PID 2928 wrote to memory of 300	2928	00b85d11a092d4f0fb108adb094154c4.exe	21
PID 2928 wrote to memory of 300	2928	00b85d11a092d4f0fb108adb094154c4.exe	21

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:488

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:480
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:852
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1060
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:356
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:1964
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:2196
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1116
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:300
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:988
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:820
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:772
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:688
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:608

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:396

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:384
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:496

C:\Users\Admin\AppData\Local\Temp\00b85d11a092d4f0fb108adb094154c4.exe
"C:\Users\Admin\AppData\Local\Temp\00b85d11a092d4f0fb108adb094154c4.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2928

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1944

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1208

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2928-2-0x000000007752F000-0x0000000077530000-memory.dmp

Filesize
4KB

Download
memory/2928-1-0x0000000077530000-0x0000000077531000-memory.dmp

Filesize
4KB

Download
memory/2928-0-0x0000000001000000-0x0000000001028000-memory.dmp

Filesize
160KB

Download
memory/2928-3-0x0000000001000000-0x0000000001028000-memory.dmp

Filesize
160KB

Download