786e925b0401aeb92cd2a200a7afcf03fa8a49fdf4eed29f2dcb88ebf22e1d61

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 06:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

117d965ae8c01edce9c5f85d3f468604.exe
Size

397KB
MD5

117d965ae8c01edce9c5f85d3f468604
SHA1

c9c040fbccc82601d9b0d66fdbac2f32afff614c
SHA256

786e925b0401aeb92cd2a200a7afcf03fa8a49fdf4eed29f2dcb88ebf22e1d61
SHA512

6c91513249ded2567e60f9be4adbc47cc299a5fd07ea2a03362d3e3adbea6c30d6d4607c1612e77f3ae1e40dfc53df98a61a7e20a8ed78cd047245335fe41ea7
SSDEEP

6144:NhE1+bhN9Ofb9manj+4t0XMPChlE9Ayyx1TGOwCb54EWPzRB2dQU6711trUhAk5n:c1+bhNofBNjoMPChu7H4CvuyGzJZ

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1768 set thread context of 1264	1768	117d965ae8c01edce9c5f85d3f468604.exe	28

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\360\360rpt.exe	117d965ae8c01edce9c5f85d3f468604.exe
File opened for modification	C:\Program Files (x86)\360\360rpt.exe	117d965ae8c01edce9c5f85d3f468604.exe
File opened for modification	C:\Program Files (x86)\360\plugin.dat	117d965ae8c01edce9c5f85d3f468604.exe
File opened for modification	C:\Program Files (x86)\360\	117d965ae8c01edce9c5f85d3f468604.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1264	117d965ae8c01edce9c5f85d3f468604.exe
1264	117d965ae8c01edce9c5f85d3f468604.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1264	117d965ae8c01edce9c5f85d3f468604.exe
Token: SeDebugPrivilege	1264	117d965ae8c01edce9c5f85d3f468604.exe
Token: SeDebugPrivilege	1264	117d965ae8c01edce9c5f85d3f468604.exe
Token: SeDebugPrivilege	1264	117d965ae8c01edce9c5f85d3f468604.exe
Token: SeDebugPrivilege	2692	117d965ae8c01edce9c5f85d3f468604.exe
Token: SeDebugPrivilege	2692	117d965ae8c01edce9c5f85d3f468604.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 1264	1768	117d965ae8c01edce9c5f85d3f468604.exe	28
PID 1768 wrote to memory of 1264	1768	117d965ae8c01edce9c5f85d3f468604.exe	28
PID 1768 wrote to memory of 1264	1768	117d965ae8c01edce9c5f85d3f468604.exe	28
PID 1768 wrote to memory of 1264	1768	117d965ae8c01edce9c5f85d3f468604.exe	28
PID 1768 wrote to memory of 1264	1768	117d965ae8c01edce9c5f85d3f468604.exe	28
PID 1768 wrote to memory of 1264	1768	117d965ae8c01edce9c5f85d3f468604.exe	28
PID 1768 wrote to memory of 1264	1768	117d965ae8c01edce9c5f85d3f468604.exe	28
PID 1768 wrote to memory of 1264	1768	117d965ae8c01edce9c5f85d3f468604.exe	28
PID 1768 wrote to memory of 1264	1768	117d965ae8c01edce9c5f85d3f468604.exe	28
PID 1768 wrote to memory of 1264	1768	117d965ae8c01edce9c5f85d3f468604.exe	28
PID 1768 wrote to memory of 1264	1768	117d965ae8c01edce9c5f85d3f468604.exe	28
PID 1768 wrote to memory of 1264	1768	117d965ae8c01edce9c5f85d3f468604.exe	28
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7
PID 1264 wrote to memory of 260	1264	117d965ae8c01edce9c5f85d3f468604.exe	7

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:484

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:468
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:676
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:972
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:280
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1044
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:388
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1136
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:860
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:816
- - C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    3⤵
    PID:1240
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:752
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:596
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:2272
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:1384

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:384

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:372
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:492

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:336

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:260

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1272
- C:\Users\Admin\AppData\Local\Temp\117d965ae8c01edce9c5f85d3f468604.exe
  "C:\Users\Admin\AppData\Local\Temp\117d965ae8c01edce9c5f85d3f468604.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1768
- - C:\Users\Admin\AppData\Local\Temp\117d965ae8c01edce9c5f85d3f468604.exe
    C:\Users\Admin\AppData\Local\Temp\117d965ae8c01edce9c5f85d3f468604.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1264
  - - C:\Users\Admin\AppData\Local\Temp\117d965ae8c01edce9c5f85d3f468604.exe
      C:\Users\Admin\AppData\Local\Temp\117d965ae8c01edce9c5f85d3f468604.exe
      4⤵
      Drops file in Program Files directory
      Suspicious use of AdjustPrivilegeToken
      PID:2692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/260-45-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/1264-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1264-24-0x0000000000260000-0x0000000000290000-memory.dmp

Filesize
192KB

Download
memory/1264-7-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1264-10-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1264-13-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1264-15-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1264-17-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1264-3-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1264-5-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1264-22-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1264-4-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1264-31-0x0000000000290000-0x000000000029A000-memory.dmp

Filesize
40KB

Download
memory/1264-38-0x00000000002A0000-0x00000000002AA000-memory.dmp

Filesize
40KB

Download
memory/1768-21-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/2692-8811-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2692-8833-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/2692-11223-0x0000000010570000-0x00000000105A0000-memory.dmp

Filesize
192KB

Download
memory/2692-11229-0x0000000010570000-0x00000000105A0000-memory.dmp

Filesize
192KB

Download