057b7495b6f26b8cdda5211ae204155bc9f38d662d039a8f4e153c2da5013d3e

Analysis

max time kernel
143s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 21:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b16ef3337a75bb0eb77dfc4f54072fb.exe
Size

109KB
MD5

3b16ef3337a75bb0eb77dfc4f54072fb
SHA1

3823dee30e8d2837503eda937332c8c2e9cae900
SHA256

057b7495b6f26b8cdda5211ae204155bc9f38d662d039a8f4e153c2da5013d3e
SHA512

6b8a4e8241c9a4fde261587e2c4edf021465ed5cf1f75995f835fc2df0acd2e3874eca0fb947ded708887cdf94add418d2c180b5a59a763d5d02d7207c0f9dc4
SSDEEP

3072:TxiZVe8LdkBp8uSNoiI6RXNWDr4BbpVfHa:TEZVe1/HSNoFwNoUBbL6

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe

Suspicious behavior: MapViewOfSection 21 IoCs

pid	Process
2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe
2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe
2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe
2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe
2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe
2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe
2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe
2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe
2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe
2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe
2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe
2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe
2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe
2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe
2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe
2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe
2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe
2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe
2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe
2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe
2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 372	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	2
PID 2076 wrote to memory of 372	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	2
PID 2076 wrote to memory of 372	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	2
PID 2076 wrote to memory of 372	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	2
PID 2076 wrote to memory of 372	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	2
PID 2076 wrote to memory of 372	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	2
PID 2076 wrote to memory of 372	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	2
PID 2076 wrote to memory of 380	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	1
PID 2076 wrote to memory of 380	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	1
PID 2076 wrote to memory of 380	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	1
PID 2076 wrote to memory of 380	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	1
PID 2076 wrote to memory of 380	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	1
PID 2076 wrote to memory of 380	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	1
PID 2076 wrote to memory of 380	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	1
PID 2076 wrote to memory of 420	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	5
PID 2076 wrote to memory of 420	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	5
PID 2076 wrote to memory of 420	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	5
PID 2076 wrote to memory of 420	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	5
PID 2076 wrote to memory of 420	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	5
PID 2076 wrote to memory of 420	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	5
PID 2076 wrote to memory of 420	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	5
PID 2076 wrote to memory of 464	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	6
PID 2076 wrote to memory of 464	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	6
PID 2076 wrote to memory of 464	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	6
PID 2076 wrote to memory of 464	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	6
PID 2076 wrote to memory of 464	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	6
PID 2076 wrote to memory of 464	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	6
PID 2076 wrote to memory of 464	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	6
PID 2076 wrote to memory of 480	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	7
PID 2076 wrote to memory of 480	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	7
PID 2076 wrote to memory of 480	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	7
PID 2076 wrote to memory of 480	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	7
PID 2076 wrote to memory of 480	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	7
PID 2076 wrote to memory of 480	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	7
PID 2076 wrote to memory of 480	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	7
PID 2076 wrote to memory of 488	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	8
PID 2076 wrote to memory of 488	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	8
PID 2076 wrote to memory of 488	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	8
PID 2076 wrote to memory of 488	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	8
PID 2076 wrote to memory of 488	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	8
PID 2076 wrote to memory of 488	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	8
PID 2076 wrote to memory of 488	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	8
PID 2076 wrote to memory of 592	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	11
PID 2076 wrote to memory of 592	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	11
PID 2076 wrote to memory of 592	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	11
PID 2076 wrote to memory of 592	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	11
PID 2076 wrote to memory of 592	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	11
PID 2076 wrote to memory of 592	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	11
PID 2076 wrote to memory of 592	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	11
PID 2076 wrote to memory of 668	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	9
PID 2076 wrote to memory of 668	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	9
PID 2076 wrote to memory of 668	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	9
PID 2076 wrote to memory of 668	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	9
PID 2076 wrote to memory of 668	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	9
PID 2076 wrote to memory of 668	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	9
PID 2076 wrote to memory of 668	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	9
PID 2076 wrote to memory of 736	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	10
PID 2076 wrote to memory of 736	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	10
PID 2076 wrote to memory of 736	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	10
PID 2076 wrote to memory of 736	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	10
PID 2076 wrote to memory of 736	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	10
PID 2076 wrote to memory of 736	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	10
PID 2076 wrote to memory of 736	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	10
PID 2076 wrote to memory of 804	2076	3b16ef3337a75bb0eb77dfc4f54072fb.exe	12

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:380
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:464
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:668
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:736
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:592
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:1508
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:804
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1312
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:2312
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:2416
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1220
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:988
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:940
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:112
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:964
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:844
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:480
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:488

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:372

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Users\Admin\AppData\Local\Temp\3b16ef3337a75bb0eb77dfc4f54072fb.exe
"C:\Users\Admin\AppData\Local\Temp\3b16ef3337a75bb0eb77dfc4f54072fb.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2076

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1384

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2076-1-0x0000000077ABF000-0x0000000077AC0000-memory.dmp

Filesize
4KB

Download
memory/2076-3-0x0000000000360000-0x0000000000363000-memory.dmp

Filesize
12KB

Download
memory/2076-2-0x0000000077AC0000-0x0000000077AC1000-memory.dmp

Filesize
4KB

Download
memory/2076-0-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2076-6-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download