8920317801e667642587e814ab2bc47a3f86930c8cb8cd5fdc521ad72b3df08f

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
05-01-2024 17:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44039c0dc03cc5f4173adbce9783b950.exe
Size

57KB
MD5

44039c0dc03cc5f4173adbce9783b950
SHA1

ddade316668b4ac5df4475f95bc6b23a5a28b85a
SHA256

8920317801e667642587e814ab2bc47a3f86930c8cb8cd5fdc521ad72b3df08f
SHA512

2a39bb3ee83e8318f422e42e78cdf4baacea70ef23ed540ab34cb4dedb22e56107a67da019ca5fc23f2e20237f5c7b38b307dab14de92bdfbc54ffe4dee36d8e
SSDEEP

768:2LKMpusnGNFjNCS1d5ak6qsecaj89kjhy6cHtruHatJ9pO9xylnHGsGC:2EsnbEhVcR9kjk6cH5u6tJLWQksGC

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2648	44039c0dc03cc5f4173adbce9783b950.exe

Suspicious behavior: MapViewOfSection 22 IoCs

pid	Process
2648	44039c0dc03cc5f4173adbce9783b950.exe
2648	44039c0dc03cc5f4173adbce9783b950.exe
2648	44039c0dc03cc5f4173adbce9783b950.exe
2648	44039c0dc03cc5f4173adbce9783b950.exe
2648	44039c0dc03cc5f4173adbce9783b950.exe
2648	44039c0dc03cc5f4173adbce9783b950.exe
2648	44039c0dc03cc5f4173adbce9783b950.exe
2648	44039c0dc03cc5f4173adbce9783b950.exe
2648	44039c0dc03cc5f4173adbce9783b950.exe
2648	44039c0dc03cc5f4173adbce9783b950.exe
2648	44039c0dc03cc5f4173adbce9783b950.exe
2648	44039c0dc03cc5f4173adbce9783b950.exe
2648	44039c0dc03cc5f4173adbce9783b950.exe
2648	44039c0dc03cc5f4173adbce9783b950.exe
2648	44039c0dc03cc5f4173adbce9783b950.exe
2648	44039c0dc03cc5f4173adbce9783b950.exe
2648	44039c0dc03cc5f4173adbce9783b950.exe
2648	44039c0dc03cc5f4173adbce9783b950.exe
2648	44039c0dc03cc5f4173adbce9783b950.exe
2648	44039c0dc03cc5f4173adbce9783b950.exe
2648	44039c0dc03cc5f4173adbce9783b950.exe
2648	44039c0dc03cc5f4173adbce9783b950.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2648	44039c0dc03cc5f4173adbce9783b950.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 384	2648	44039c0dc03cc5f4173adbce9783b950.exe	26
PID 2648 wrote to memory of 384	2648	44039c0dc03cc5f4173adbce9783b950.exe	26
PID 2648 wrote to memory of 384	2648	44039c0dc03cc5f4173adbce9783b950.exe	26
PID 2648 wrote to memory of 384	2648	44039c0dc03cc5f4173adbce9783b950.exe	26
PID 2648 wrote to memory of 384	2648	44039c0dc03cc5f4173adbce9783b950.exe	26
PID 2648 wrote to memory of 384	2648	44039c0dc03cc5f4173adbce9783b950.exe	26
PID 2648 wrote to memory of 384	2648	44039c0dc03cc5f4173adbce9783b950.exe	26
PID 2648 wrote to memory of 400	2648	44039c0dc03cc5f4173adbce9783b950.exe	25
PID 2648 wrote to memory of 400	2648	44039c0dc03cc5f4173adbce9783b950.exe	25
PID 2648 wrote to memory of 400	2648	44039c0dc03cc5f4173adbce9783b950.exe	25
PID 2648 wrote to memory of 400	2648	44039c0dc03cc5f4173adbce9783b950.exe	25
PID 2648 wrote to memory of 400	2648	44039c0dc03cc5f4173adbce9783b950.exe	25
PID 2648 wrote to memory of 400	2648	44039c0dc03cc5f4173adbce9783b950.exe	25
PID 2648 wrote to memory of 400	2648	44039c0dc03cc5f4173adbce9783b950.exe	25
PID 2648 wrote to memory of 436	2648	44039c0dc03cc5f4173adbce9783b950.exe	24
PID 2648 wrote to memory of 436	2648	44039c0dc03cc5f4173adbce9783b950.exe	24
PID 2648 wrote to memory of 436	2648	44039c0dc03cc5f4173adbce9783b950.exe	24
PID 2648 wrote to memory of 436	2648	44039c0dc03cc5f4173adbce9783b950.exe	24
PID 2648 wrote to memory of 436	2648	44039c0dc03cc5f4173adbce9783b950.exe	24
PID 2648 wrote to memory of 436	2648	44039c0dc03cc5f4173adbce9783b950.exe	24
PID 2648 wrote to memory of 436	2648	44039c0dc03cc5f4173adbce9783b950.exe	24
PID 2648 wrote to memory of 480	2648	44039c0dc03cc5f4173adbce9783b950.exe	23
PID 2648 wrote to memory of 480	2648	44039c0dc03cc5f4173adbce9783b950.exe	23
PID 2648 wrote to memory of 480	2648	44039c0dc03cc5f4173adbce9783b950.exe	23
PID 2648 wrote to memory of 480	2648	44039c0dc03cc5f4173adbce9783b950.exe	23
PID 2648 wrote to memory of 480	2648	44039c0dc03cc5f4173adbce9783b950.exe	23
PID 2648 wrote to memory of 480	2648	44039c0dc03cc5f4173adbce9783b950.exe	23
PID 2648 wrote to memory of 480	2648	44039c0dc03cc5f4173adbce9783b950.exe	23
PID 2648 wrote to memory of 496	2648	44039c0dc03cc5f4173adbce9783b950.exe	22
PID 2648 wrote to memory of 496	2648	44039c0dc03cc5f4173adbce9783b950.exe	22
PID 2648 wrote to memory of 496	2648	44039c0dc03cc5f4173adbce9783b950.exe	22
PID 2648 wrote to memory of 496	2648	44039c0dc03cc5f4173adbce9783b950.exe	22
PID 2648 wrote to memory of 496	2648	44039c0dc03cc5f4173adbce9783b950.exe	22
PID 2648 wrote to memory of 496	2648	44039c0dc03cc5f4173adbce9783b950.exe	22
PID 2648 wrote to memory of 496	2648	44039c0dc03cc5f4173adbce9783b950.exe	22
PID 2648 wrote to memory of 504	2648	44039c0dc03cc5f4173adbce9783b950.exe	21
PID 2648 wrote to memory of 504	2648	44039c0dc03cc5f4173adbce9783b950.exe	21
PID 2648 wrote to memory of 504	2648	44039c0dc03cc5f4173adbce9783b950.exe	21
PID 2648 wrote to memory of 504	2648	44039c0dc03cc5f4173adbce9783b950.exe	21
PID 2648 wrote to memory of 504	2648	44039c0dc03cc5f4173adbce9783b950.exe	21
PID 2648 wrote to memory of 504	2648	44039c0dc03cc5f4173adbce9783b950.exe	21
PID 2648 wrote to memory of 504	2648	44039c0dc03cc5f4173adbce9783b950.exe	21
PID 2648 wrote to memory of 604	2648	44039c0dc03cc5f4173adbce9783b950.exe	20
PID 2648 wrote to memory of 604	2648	44039c0dc03cc5f4173adbce9783b950.exe	20
PID 2648 wrote to memory of 604	2648	44039c0dc03cc5f4173adbce9783b950.exe	20
PID 2648 wrote to memory of 604	2648	44039c0dc03cc5f4173adbce9783b950.exe	20
PID 2648 wrote to memory of 604	2648	44039c0dc03cc5f4173adbce9783b950.exe	20
PID 2648 wrote to memory of 604	2648	44039c0dc03cc5f4173adbce9783b950.exe	20
PID 2648 wrote to memory of 604	2648	44039c0dc03cc5f4173adbce9783b950.exe	20
PID 2648 wrote to memory of 676	2648	44039c0dc03cc5f4173adbce9783b950.exe	19
PID 2648 wrote to memory of 676	2648	44039c0dc03cc5f4173adbce9783b950.exe	19
PID 2648 wrote to memory of 676	2648	44039c0dc03cc5f4173adbce9783b950.exe	19
PID 2648 wrote to memory of 676	2648	44039c0dc03cc5f4173adbce9783b950.exe	19
PID 2648 wrote to memory of 676	2648	44039c0dc03cc5f4173adbce9783b950.exe	19
PID 2648 wrote to memory of 676	2648	44039c0dc03cc5f4173adbce9783b950.exe	19
PID 2648 wrote to memory of 676	2648	44039c0dc03cc5f4173adbce9783b950.exe	19
PID 2648 wrote to memory of 768	2648	44039c0dc03cc5f4173adbce9783b950.exe	18
PID 2648 wrote to memory of 768	2648	44039c0dc03cc5f4173adbce9783b950.exe	18
PID 2648 wrote to memory of 768	2648	44039c0dc03cc5f4173adbce9783b950.exe	18
PID 2648 wrote to memory of 768	2648	44039c0dc03cc5f4173adbce9783b950.exe	18
PID 2648 wrote to memory of 768	2648	44039c0dc03cc5f4173adbce9783b950.exe	18
PID 2648 wrote to memory of 768	2648	44039c0dc03cc5f4173adbce9783b950.exe	18
PID 2648 wrote to memory of 768	2648	44039c0dc03cc5f4173adbce9783b950.exe	18
PID 2648 wrote to memory of 820	2648	44039c0dc03cc5f4173adbce9783b950.exe	17

C:\Users\Admin\AppData\Local\Temp\44039c0dc03cc5f4173adbce9783b950.exe
"C:\Users\Admin\AppData\Local\Temp\44039c0dc03cc5f4173adbce9783b950.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2648

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
1⤵
PID:944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
1⤵
PID:2112

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1336

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1312

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1280

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-404469038-1875189742937703781760571988-219346316149737914-1961261675923030877"
1⤵
PID:1044

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
1⤵
PID:240

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
1⤵
PID:300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
1⤵
PID:992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:844

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
1⤵
PID:820

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
1⤵
PID:676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
1⤵
PID:604

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:504

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:496

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:480

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:436

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:400

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:384

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2648-0-0x0000000001000000-0x0000000001012000-memory.dmp

Filesize
72KB

Download
memory/2648-1-0x000000007798F000-0x0000000077990000-memory.dmp

Filesize
4KB

Download
memory/2648-2-0x0000000077990000-0x0000000077991000-memory.dmp

Filesize
4KB

Download