15baaf79938173bd6505ba2bfe187efe5c8eac78406bc29907f10af2789c3df6

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 05:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

105241da1a54da90ace9ad228d44c901.exe
Size

1.8MB
MD5

105241da1a54da90ace9ad228d44c901
SHA1

4dc7f9713881c445a47b9dcd73abd8896ac46ae3
SHA256

15baaf79938173bd6505ba2bfe187efe5c8eac78406bc29907f10af2789c3df6
SHA512

bb7ef023a2650e2fd107d3a75b8ad0c9ea5f97ffaf83de5a60d1da66de9dbdd775f73883b41b1f9e0590af830cf2a2098b7372bdc6193ce0cc41fa62186554e3
SSDEEP

24576:mMjhs2I21YwPd1Y+rFzn5D8YgJ6xORZ6rAiv1Zr+P1M81bDf4bKVzox1/OMAKfKw:llBPd1Y+B5/gJ6a6TnGqKVG1/OtAK6Jl

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2496	105241da1a54da90ace9ad228d44c901.exe

Suspicious behavior: MapViewOfSection 21 IoCs

pid	Process
2496	105241da1a54da90ace9ad228d44c901.exe
2496	105241da1a54da90ace9ad228d44c901.exe
2496	105241da1a54da90ace9ad228d44c901.exe
2496	105241da1a54da90ace9ad228d44c901.exe
2496	105241da1a54da90ace9ad228d44c901.exe
2496	105241da1a54da90ace9ad228d44c901.exe
2496	105241da1a54da90ace9ad228d44c901.exe
2496	105241da1a54da90ace9ad228d44c901.exe
2496	105241da1a54da90ace9ad228d44c901.exe
2496	105241da1a54da90ace9ad228d44c901.exe
2496	105241da1a54da90ace9ad228d44c901.exe
2496	105241da1a54da90ace9ad228d44c901.exe
2496	105241da1a54da90ace9ad228d44c901.exe
2496	105241da1a54da90ace9ad228d44c901.exe
2496	105241da1a54da90ace9ad228d44c901.exe
2496	105241da1a54da90ace9ad228d44c901.exe
2496	105241da1a54da90ace9ad228d44c901.exe
2496	105241da1a54da90ace9ad228d44c901.exe
2496	105241da1a54da90ace9ad228d44c901.exe
2496	105241da1a54da90ace9ad228d44c901.exe
2496	105241da1a54da90ace9ad228d44c901.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2496	105241da1a54da90ace9ad228d44c901.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 372	2496	105241da1a54da90ace9ad228d44c901.exe	5
PID 2496 wrote to memory of 372	2496	105241da1a54da90ace9ad228d44c901.exe	5
PID 2496 wrote to memory of 372	2496	105241da1a54da90ace9ad228d44c901.exe	5
PID 2496 wrote to memory of 372	2496	105241da1a54da90ace9ad228d44c901.exe	5
PID 2496 wrote to memory of 372	2496	105241da1a54da90ace9ad228d44c901.exe	5
PID 2496 wrote to memory of 372	2496	105241da1a54da90ace9ad228d44c901.exe	5
PID 2496 wrote to memory of 372	2496	105241da1a54da90ace9ad228d44c901.exe	5
PID 2496 wrote to memory of 380	2496	105241da1a54da90ace9ad228d44c901.exe	4
PID 2496 wrote to memory of 380	2496	105241da1a54da90ace9ad228d44c901.exe	4
PID 2496 wrote to memory of 380	2496	105241da1a54da90ace9ad228d44c901.exe	4
PID 2496 wrote to memory of 380	2496	105241da1a54da90ace9ad228d44c901.exe	4
PID 2496 wrote to memory of 380	2496	105241da1a54da90ace9ad228d44c901.exe	4
PID 2496 wrote to memory of 380	2496	105241da1a54da90ace9ad228d44c901.exe	4
PID 2496 wrote to memory of 380	2496	105241da1a54da90ace9ad228d44c901.exe	4
PID 2496 wrote to memory of 420	2496	105241da1a54da90ace9ad228d44c901.exe	3
PID 2496 wrote to memory of 420	2496	105241da1a54da90ace9ad228d44c901.exe	3
PID 2496 wrote to memory of 420	2496	105241da1a54da90ace9ad228d44c901.exe	3
PID 2496 wrote to memory of 420	2496	105241da1a54da90ace9ad228d44c901.exe	3
PID 2496 wrote to memory of 420	2496	105241da1a54da90ace9ad228d44c901.exe	3
PID 2496 wrote to memory of 420	2496	105241da1a54da90ace9ad228d44c901.exe	3
PID 2496 wrote to memory of 420	2496	105241da1a54da90ace9ad228d44c901.exe	3
PID 2496 wrote to memory of 468	2496	105241da1a54da90ace9ad228d44c901.exe	2
PID 2496 wrote to memory of 468	2496	105241da1a54da90ace9ad228d44c901.exe	2
PID 2496 wrote to memory of 468	2496	105241da1a54da90ace9ad228d44c901.exe	2
PID 2496 wrote to memory of 468	2496	105241da1a54da90ace9ad228d44c901.exe	2
PID 2496 wrote to memory of 468	2496	105241da1a54da90ace9ad228d44c901.exe	2
PID 2496 wrote to memory of 468	2496	105241da1a54da90ace9ad228d44c901.exe	2
PID 2496 wrote to memory of 468	2496	105241da1a54da90ace9ad228d44c901.exe	2
PID 2496 wrote to memory of 476	2496	105241da1a54da90ace9ad228d44c901.exe	1
PID 2496 wrote to memory of 476	2496	105241da1a54da90ace9ad228d44c901.exe	1
PID 2496 wrote to memory of 476	2496	105241da1a54da90ace9ad228d44c901.exe	1
PID 2496 wrote to memory of 476	2496	105241da1a54da90ace9ad228d44c901.exe	1
PID 2496 wrote to memory of 476	2496	105241da1a54da90ace9ad228d44c901.exe	1
PID 2496 wrote to memory of 476	2496	105241da1a54da90ace9ad228d44c901.exe	1
PID 2496 wrote to memory of 476	2496	105241da1a54da90ace9ad228d44c901.exe	1
PID 2496 wrote to memory of 484	2496	105241da1a54da90ace9ad228d44c901.exe	8
PID 2496 wrote to memory of 484	2496	105241da1a54da90ace9ad228d44c901.exe	8
PID 2496 wrote to memory of 484	2496	105241da1a54da90ace9ad228d44c901.exe	8
PID 2496 wrote to memory of 484	2496	105241da1a54da90ace9ad228d44c901.exe	8
PID 2496 wrote to memory of 484	2496	105241da1a54da90ace9ad228d44c901.exe	8
PID 2496 wrote to memory of 484	2496	105241da1a54da90ace9ad228d44c901.exe	8
PID 2496 wrote to memory of 484	2496	105241da1a54da90ace9ad228d44c901.exe	8
PID 2496 wrote to memory of 596	2496	105241da1a54da90ace9ad228d44c901.exe	26
PID 2496 wrote to memory of 596	2496	105241da1a54da90ace9ad228d44c901.exe	26
PID 2496 wrote to memory of 596	2496	105241da1a54da90ace9ad228d44c901.exe	26
PID 2496 wrote to memory of 596	2496	105241da1a54da90ace9ad228d44c901.exe	26
PID 2496 wrote to memory of 596	2496	105241da1a54da90ace9ad228d44c901.exe	26
PID 2496 wrote to memory of 596	2496	105241da1a54da90ace9ad228d44c901.exe	26
PID 2496 wrote to memory of 596	2496	105241da1a54da90ace9ad228d44c901.exe	26
PID 2496 wrote to memory of 672	2496	105241da1a54da90ace9ad228d44c901.exe	25
PID 2496 wrote to memory of 672	2496	105241da1a54da90ace9ad228d44c901.exe	25
PID 2496 wrote to memory of 672	2496	105241da1a54da90ace9ad228d44c901.exe	25
PID 2496 wrote to memory of 672	2496	105241da1a54da90ace9ad228d44c901.exe	25
PID 2496 wrote to memory of 672	2496	105241da1a54da90ace9ad228d44c901.exe	25
PID 2496 wrote to memory of 672	2496	105241da1a54da90ace9ad228d44c901.exe	25
PID 2496 wrote to memory of 672	2496	105241da1a54da90ace9ad228d44c901.exe	25
PID 2496 wrote to memory of 756	2496	105241da1a54da90ace9ad228d44c901.exe	24
PID 2496 wrote to memory of 756	2496	105241da1a54da90ace9ad228d44c901.exe	24
PID 2496 wrote to memory of 756	2496	105241da1a54da90ace9ad228d44c901.exe	24
PID 2496 wrote to memory of 756	2496	105241da1a54da90ace9ad228d44c901.exe	24
PID 2496 wrote to memory of 756	2496	105241da1a54da90ace9ad228d44c901.exe	24
PID 2496 wrote to memory of 756	2496	105241da1a54da90ace9ad228d44c901.exe	24
PID 2496 wrote to memory of 756	2496	105241da1a54da90ace9ad228d44c901.exe	24
PID 2496 wrote to memory of 812	2496	105241da1a54da90ace9ad228d44c901.exe	23

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:476

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:468
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1124
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:2360
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:2116
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1032
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:1012
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:276
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:968
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:844
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:812
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:756
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:672
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:596

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:380

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:372
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:484

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1072

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1284
- C:\Users\Admin\AppData\Local\Temp\105241da1a54da90ace9ad228d44c901.exe
  "C:\Users\Admin\AppData\Local\Temp\105241da1a54da90ace9ad228d44c901.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2496

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2496-0-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2496-2-0x0000000077A10000-0x0000000077A11000-memory.dmp

Filesize
4KB

Download
memory/2496-1-0x0000000077A0F000-0x0000000077A10000-memory.dmp

Filesize
4KB

Download
memory/2496-3-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2496-6-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download