4fcc150d5a31b78a9a619c62e95fd4a1e4e132a5cf261881b06e2f8a76f84e36

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 07:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d7479c7725ea48ef2bde8ac454d2771.exe
Size

916KB
MD5

2d7479c7725ea48ef2bde8ac454d2771
SHA1

cc1ff66ff4cfbf6d9fd68e5544be870047c87f1f
SHA256

4fcc150d5a31b78a9a619c62e95fd4a1e4e132a5cf261881b06e2f8a76f84e36
SHA512

62b052f669ba909a30e1d314c366a56e41e489740efde24faaff305562dfe29b8e6bc23d24b7a50352912a2b2fd6c951cdb822470fd726a5416b19925b06bfd7
SSDEEP

12288:lgBD8VRCxnU7BiGq8F+MJS/euQY7xypq6493RJvw91bo7jzvi2nTn2:tzCUNRq8F+oweuQKc4hRa/boXzvv

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2036	2d7479c7725ea48ef2bde8ac454d2771.exe
2036	2d7479c7725ea48ef2bde8ac454d2771.exe
2036	2d7479c7725ea48ef2bde8ac454d2771.exe
2036	2d7479c7725ea48ef2bde8ac454d2771.exe
2036	2d7479c7725ea48ef2bde8ac454d2771.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2036	2d7479c7725ea48ef2bde8ac454d2771.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2796	2036	2d7479c7725ea48ef2bde8ac454d2771.exe	32
PID 2036 wrote to memory of 2796	2036	2d7479c7725ea48ef2bde8ac454d2771.exe	32
PID 2036 wrote to memory of 2796	2036	2d7479c7725ea48ef2bde8ac454d2771.exe	32
PID 2036 wrote to memory of 2796	2036	2d7479c7725ea48ef2bde8ac454d2771.exe	32
PID 2036 wrote to memory of 2872	2036	2d7479c7725ea48ef2bde8ac454d2771.exe	31
PID 2036 wrote to memory of 2872	2036	2d7479c7725ea48ef2bde8ac454d2771.exe	31
PID 2036 wrote to memory of 2872	2036	2d7479c7725ea48ef2bde8ac454d2771.exe	31
PID 2036 wrote to memory of 2872	2036	2d7479c7725ea48ef2bde8ac454d2771.exe	31
PID 2036 wrote to memory of 2684	2036	2d7479c7725ea48ef2bde8ac454d2771.exe	30
PID 2036 wrote to memory of 2684	2036	2d7479c7725ea48ef2bde8ac454d2771.exe	30
PID 2036 wrote to memory of 2684	2036	2d7479c7725ea48ef2bde8ac454d2771.exe	30
PID 2036 wrote to memory of 2684	2036	2d7479c7725ea48ef2bde8ac454d2771.exe	30
PID 2036 wrote to memory of 2868	2036	2d7479c7725ea48ef2bde8ac454d2771.exe	29
PID 2036 wrote to memory of 2868	2036	2d7479c7725ea48ef2bde8ac454d2771.exe	29
PID 2036 wrote to memory of 2868	2036	2d7479c7725ea48ef2bde8ac454d2771.exe	29
PID 2036 wrote to memory of 2868	2036	2d7479c7725ea48ef2bde8ac454d2771.exe	29
PID 2036 wrote to memory of 2084	2036	2d7479c7725ea48ef2bde8ac454d2771.exe	28
PID 2036 wrote to memory of 2084	2036	2d7479c7725ea48ef2bde8ac454d2771.exe	28
PID 2036 wrote to memory of 2084	2036	2d7479c7725ea48ef2bde8ac454d2771.exe	28
PID 2036 wrote to memory of 2084	2036	2d7479c7725ea48ef2bde8ac454d2771.exe	28

C:\Users\Admin\AppData\Local\Temp\2d7479c7725ea48ef2bde8ac454d2771.exe
"C:\Users\Admin\AppData\Local\Temp\2d7479c7725ea48ef2bde8ac454d2771.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Users\Admin\AppData\Local\Temp\2d7479c7725ea48ef2bde8ac454d2771.exe
  "C:\Users\Admin\AppData\Local\Temp\2d7479c7725ea48ef2bde8ac454d2771.exe"
  2⤵
  PID:2084
- C:\Users\Admin\AppData\Local\Temp\2d7479c7725ea48ef2bde8ac454d2771.exe
  "C:\Users\Admin\AppData\Local\Temp\2d7479c7725ea48ef2bde8ac454d2771.exe"
  2⤵
  PID:2868
- C:\Users\Admin\AppData\Local\Temp\2d7479c7725ea48ef2bde8ac454d2771.exe
  "C:\Users\Admin\AppData\Local\Temp\2d7479c7725ea48ef2bde8ac454d2771.exe"
  2⤵
  PID:2684
- C:\Users\Admin\AppData\Local\Temp\2d7479c7725ea48ef2bde8ac454d2771.exe
  "C:\Users\Admin\AppData\Local\Temp\2d7479c7725ea48ef2bde8ac454d2771.exe"
  2⤵
  PID:2872
- C:\Users\Admin\AppData\Local\Temp\2d7479c7725ea48ef2bde8ac454d2771.exe
  "C:\Users\Admin\AppData\Local\Temp\2d7479c7725ea48ef2bde8ac454d2771.exe"
  2⤵
  PID:2796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2036-1-0x0000000074BA0000-0x000000007528E000-memory.dmp

Filesize
6.9MB

Download
memory/2036-0-0x0000000000370000-0x000000000045C000-memory.dmp

Filesize
944KB

Download
memory/2036-2-0x0000000004C40000-0x0000000004C80000-memory.dmp

Filesize
256KB

Download
memory/2036-3-0x00000000004B0000-0x00000000004CC000-memory.dmp

Filesize
112KB

Download
memory/2036-4-0x0000000074BA0000-0x000000007528E000-memory.dmp

Filesize
6.9MB

Download
memory/2036-5-0x0000000004C40000-0x0000000004C80000-memory.dmp

Filesize
256KB

Download
memory/2036-6-0x00000000056E0000-0x000000000577A000-memory.dmp

Filesize
616KB

Download
memory/2036-7-0x0000000005090000-0x00000000050F6000-memory.dmp

Filesize
408KB

Download
memory/2036-8-0x0000000074BA0000-0x000000007528E000-memory.dmp

Filesize
6.9MB

Download