23c4cdd259a2b1a3f0bbbd7e061b7b15df8004f7c7cf20114ac66961168f930b

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 02:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0af2fc05dfc8ec4765faef37aeecd9ec.exe
Size

32KB
MD5

0af2fc05dfc8ec4765faef37aeecd9ec
SHA1

43955c79aafa284496e2fa6006a6272dc3dcd449
SHA256

23c4cdd259a2b1a3f0bbbd7e061b7b15df8004f7c7cf20114ac66961168f930b
SHA512

2c00ef31f779d3a5884b2a47939c718d13e0d257021c7e009fc912a09aa8200bf985e93a6ec7797f955758ddefbab3359308a3fb42600fa8c26a2aefa18e4cf4
SSDEEP

768:ZH642JWdZIiXavtSkX3TtjfIfVq9K5nYI1+OEPYZd:ZXzIiXavtS235fcF5YIP

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe

Suspicious behavior: MapViewOfSection 22 IoCs

pid	Process
2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe
2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe
2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe
2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe
2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe
2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe
2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe
2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe
2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe
2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe
2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe
2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe
2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe
2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe
2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe
2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe
2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe
2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe
2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe
2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe
2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe
2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 388	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	26
PID 2548 wrote to memory of 388	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	26
PID 2548 wrote to memory of 388	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	26
PID 2548 wrote to memory of 388	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	26
PID 2548 wrote to memory of 388	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	26
PID 2548 wrote to memory of 388	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	26
PID 2548 wrote to memory of 400	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	25
PID 2548 wrote to memory of 400	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	25
PID 2548 wrote to memory of 400	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	25
PID 2548 wrote to memory of 400	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	25
PID 2548 wrote to memory of 400	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	25
PID 2548 wrote to memory of 400	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	25
PID 2548 wrote to memory of 436	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	24
PID 2548 wrote to memory of 436	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	24
PID 2548 wrote to memory of 436	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	24
PID 2548 wrote to memory of 436	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	24
PID 2548 wrote to memory of 436	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	24
PID 2548 wrote to memory of 436	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	24
PID 2548 wrote to memory of 480	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	23
PID 2548 wrote to memory of 480	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	23
PID 2548 wrote to memory of 480	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	23
PID 2548 wrote to memory of 480	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	23
PID 2548 wrote to memory of 480	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	23
PID 2548 wrote to memory of 480	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	23
PID 2548 wrote to memory of 496	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	22
PID 2548 wrote to memory of 496	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	22
PID 2548 wrote to memory of 496	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	22
PID 2548 wrote to memory of 496	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	22
PID 2548 wrote to memory of 496	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	22
PID 2548 wrote to memory of 496	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	22
PID 2548 wrote to memory of 504	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	21
PID 2548 wrote to memory of 504	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	21
PID 2548 wrote to memory of 504	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	21
PID 2548 wrote to memory of 504	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	21
PID 2548 wrote to memory of 504	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	21
PID 2548 wrote to memory of 504	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	21
PID 2548 wrote to memory of 600	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	20
PID 2548 wrote to memory of 600	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	20
PID 2548 wrote to memory of 600	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	20
PID 2548 wrote to memory of 600	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	20
PID 2548 wrote to memory of 600	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	20
PID 2548 wrote to memory of 600	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	20
PID 2548 wrote to memory of 676	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	19
PID 2548 wrote to memory of 676	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	19
PID 2548 wrote to memory of 676	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	19
PID 2548 wrote to memory of 676	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	19
PID 2548 wrote to memory of 676	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	19
PID 2548 wrote to memory of 676	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	19
PID 2548 wrote to memory of 752	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	18
PID 2548 wrote to memory of 752	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	18
PID 2548 wrote to memory of 752	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	18
PID 2548 wrote to memory of 752	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	18
PID 2548 wrote to memory of 752	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	18
PID 2548 wrote to memory of 752	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	18
PID 2548 wrote to memory of 824	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	17
PID 2548 wrote to memory of 824	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	17
PID 2548 wrote to memory of 824	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	17
PID 2548 wrote to memory of 824	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	17
PID 2548 wrote to memory of 824	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	17
PID 2548 wrote to memory of 824	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	17
PID 2548 wrote to memory of 872	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	16
PID 2548 wrote to memory of 872	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	16
PID 2548 wrote to memory of 872	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	16
PID 2548 wrote to memory of 872	2548	0af2fc05dfc8ec4765faef37aeecd9ec.exe	16

C:\Users\Admin\AppData\Local\Temp\0af2fc05dfc8ec4765faef37aeecd9ec.exe
"C:\Users\Admin\AppData\Local\Temp\0af2fc05dfc8ec4765faef37aeecd9ec.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2548

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
1⤵
PID:2300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
1⤵
PID:2132

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1052

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1204

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "61811081-16471760597971256201508369009-353254757299507193-726038845-1843145225"
1⤵
PID:2656

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1176

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
1⤵
PID:1060

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
1⤵
PID:348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
1⤵
PID:1000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:872

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
1⤵
PID:824

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
1⤵
PID:676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
1⤵
PID:600

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:504

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:496

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:480

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:436

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:400

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2548-0-0x0000000001000000-0x000000000100C000-memory.dmp

Filesize
48KB

Download
memory/2548-1-0x00000000775E0000-0x00000000775E1000-memory.dmp

Filesize
4KB

Download
memory/2548-2-0x00000000775DF000-0x00000000775E0000-memory.dmp

Filesize
4KB

Download
memory/2548-3-0x0000000001000000-0x000000000100C000-memory.dmp

Filesize
48KB

Download