6447cac73ac33854ef0f940ef37b0ab07f9b6852d6e93b16cfc821e6a2c8756c

Analysis

max time kernel
120s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 03:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d608561f2cd7fbe41b08f9a5a01228f.exe
Size

2.7MB
MD5

0d608561f2cd7fbe41b08f9a5a01228f
SHA1

0b1ce4bde66214d64ebf50d9c7491ee933ffee64
SHA256

6447cac73ac33854ef0f940ef37b0ab07f9b6852d6e93b16cfc821e6a2c8756c
SHA512

d47fc5852fcb50c2c354d5871386ef226e3e6ce3fa3d5b0bca029fd229656daf24ca84953c2f15c98f67b9b211d3d51ef0712a738492c9e51d9d27d8a993870f
SSDEEP

49152:axO686ZUfB9XkR9RBXk5JioQrgzgvuwQFop0XF0UEoIyjT2/:axO686ifC9c5EszgvuwQFop9ToIyj6

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

0d608561f2cd7fbe41b08f9a5a01228f.exe

pid	process
840	0d608561f2cd7fbe41b08f9a5a01228f.exe
840	0d608561f2cd7fbe41b08f9a5a01228f.exe
840	0d608561f2cd7fbe41b08f9a5a01228f.exe
840	0d608561f2cd7fbe41b08f9a5a01228f.exe
840	0d608561f2cd7fbe41b08f9a5a01228f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0d608561f2cd7fbe41b08f9a5a01228f.exe

description pid process

Token: SeDebugPrivilege 840 0d608561f2cd7fbe41b08f9a5a01228f.exe

description	pid	process
Token: SeDebugPrivilege	840	0d608561f2cd7fbe41b08f9a5a01228f.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

0d608561f2cd7fbe41b08f9a5a01228f.exe

C:\Users\Admin\AppData\Local\Temp\0d608561f2cd7fbe41b08f9a5a01228f.exe
"C:\Users\Admin\AppData\Local\Temp\0d608561f2cd7fbe41b08f9a5a01228f.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:840

C:\Users\Admin\AppData\Local\Temp\0d608561f2cd7fbe41b08f9a5a01228f.exe
"C:\Users\Admin\AppData\Local\Temp\0d608561f2cd7fbe41b08f9a5a01228f.exe"
2⤵
PID:2608

C:\Users\Admin\AppData\Local\Temp\0d608561f2cd7fbe41b08f9a5a01228f.exe
"C:\Users\Admin\AppData\Local\Temp\0d608561f2cd7fbe41b08f9a5a01228f.exe"
2⤵
PID:2640

C:\Users\Admin\AppData\Local\Temp\0d608561f2cd7fbe41b08f9a5a01228f.exe
"C:\Users\Admin\AppData\Local\Temp\0d608561f2cd7fbe41b08f9a5a01228f.exe"
2⤵
PID:2620

C:\Users\Admin\AppData\Local\Temp\0d608561f2cd7fbe41b08f9a5a01228f.exe
"C:\Users\Admin\AppData\Local\Temp\0d608561f2cd7fbe41b08f9a5a01228f.exe"
2⤵
PID:2728

C:\Users\Admin\AppData\Local\Temp\0d608561f2cd7fbe41b08f9a5a01228f.exe
"C:\Users\Admin\AppData\Local\Temp\0d608561f2cd7fbe41b08f9a5a01228f.exe"
2⤵
PID:1708

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/840-0-0x0000000000070000-0x000000000032E000-memory.dmp

Filesize
2.7MB

Download
memory/840-1-0x0000000074BE0000-0x00000000752CE000-memory.dmp

Filesize
6.9MB

Download
memory/840-2-0x0000000004F30000-0x0000000004F70000-memory.dmp

Filesize
256KB

Download
memory/840-3-0x00000000006E0000-0x00000000006FE000-memory.dmp

Filesize
120KB

Download
memory/840-4-0x0000000074BE0000-0x00000000752CE000-memory.dmp

Filesize
6.9MB

Download
memory/840-5-0x0000000004F30000-0x0000000004F70000-memory.dmp

Filesize
256KB

Download
memory/840-6-0x0000000005E00000-0x0000000005FF0000-memory.dmp

Filesize
1.9MB

Download
memory/840-7-0x00000000092A0000-0x0000000009418000-memory.dmp

Filesize
1.5MB

Download
memory/840-8-0x0000000074BE0000-0x00000000752CE000-memory.dmp

Filesize
6.9MB

Download

description	pid	process	target process
PID 840 wrote to memory of 2608	840	0d608561f2cd7fbe41b08f9a5a01228f.exe	0d608561f2cd7fbe41b08f9a5a01228f.exe
PID 840 wrote to memory of 2608	840	0d608561f2cd7fbe41b08f9a5a01228f.exe	0d608561f2cd7fbe41b08f9a5a01228f.exe
PID 840 wrote to memory of 2608	840	0d608561f2cd7fbe41b08f9a5a01228f.exe	0d608561f2cd7fbe41b08f9a5a01228f.exe
PID 840 wrote to memory of 2608	840	0d608561f2cd7fbe41b08f9a5a01228f.exe	0d608561f2cd7fbe41b08f9a5a01228f.exe
PID 840 wrote to memory of 2620	840	0d608561f2cd7fbe41b08f9a5a01228f.exe	0d608561f2cd7fbe41b08f9a5a01228f.exe
PID 840 wrote to memory of 2620	840	0d608561f2cd7fbe41b08f9a5a01228f.exe	0d608561f2cd7fbe41b08f9a5a01228f.exe
PID 840 wrote to memory of 2620	840	0d608561f2cd7fbe41b08f9a5a01228f.exe	0d608561f2cd7fbe41b08f9a5a01228f.exe
PID 840 wrote to memory of 2620	840	0d608561f2cd7fbe41b08f9a5a01228f.exe	0d608561f2cd7fbe41b08f9a5a01228f.exe
PID 840 wrote to memory of 2640	840	0d608561f2cd7fbe41b08f9a5a01228f.exe	0d608561f2cd7fbe41b08f9a5a01228f.exe
PID 840 wrote to memory of 2640	840	0d608561f2cd7fbe41b08f9a5a01228f.exe	0d608561f2cd7fbe41b08f9a5a01228f.exe
PID 840 wrote to memory of 2640	840	0d608561f2cd7fbe41b08f9a5a01228f.exe	0d608561f2cd7fbe41b08f9a5a01228f.exe
PID 840 wrote to memory of 2640	840	0d608561f2cd7fbe41b08f9a5a01228f.exe	0d608561f2cd7fbe41b08f9a5a01228f.exe
PID 840 wrote to memory of 2728	840	0d608561f2cd7fbe41b08f9a5a01228f.exe	0d608561f2cd7fbe41b08f9a5a01228f.exe
PID 840 wrote to memory of 2728	840	0d608561f2cd7fbe41b08f9a5a01228f.exe	0d608561f2cd7fbe41b08f9a5a01228f.exe
PID 840 wrote to memory of 2728	840	0d608561f2cd7fbe41b08f9a5a01228f.exe	0d608561f2cd7fbe41b08f9a5a01228f.exe
PID 840 wrote to memory of 2728	840	0d608561f2cd7fbe41b08f9a5a01228f.exe	0d608561f2cd7fbe41b08f9a5a01228f.exe
PID 840 wrote to memory of 1708	840	0d608561f2cd7fbe41b08f9a5a01228f.exe	0d608561f2cd7fbe41b08f9a5a01228f.exe
PID 840 wrote to memory of 1708	840	0d608561f2cd7fbe41b08f9a5a01228f.exe	0d608561f2cd7fbe41b08f9a5a01228f.exe
PID 840 wrote to memory of 1708	840	0d608561f2cd7fbe41b08f9a5a01228f.exe	0d608561f2cd7fbe41b08f9a5a01228f.exe
PID 840 wrote to memory of 1708	840	0d608561f2cd7fbe41b08f9a5a01228f.exe	0d608561f2cd7fbe41b08f9a5a01228f.exe