Analysis

  • max time kernel
    119s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    07/01/2024, 19:37

General

  • Target

    ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe

  • Size

    55KB

  • MD5

    ac4ed2f45c49db9b1cd0fd7bb9ad241c

  • SHA1

    48fefa0dfcfb09b1fe171530c3b6df8e0abbe490

  • SHA256

    e4ce52c013c005d6f21384cd6ca2f3b2ff2cfb3f327565344054928d42019729

  • SHA512

    551c4835f6e0511910e15c0039e2edcdef88b5fae2530d36dd1c7297b93de9b1b3a0628cebd6323b05f9f791d7957f194efb73a0cd6015197c4fd4448c0e16f3

  • SSDEEP

    768:Q/Z61HdJ5+5VCz7BAmxHhh5GdUtMqTWjreQrHGF9cIdbP981cDUdSGjgP:h1HNoVCBAmxHhh+URIDrmF9/bPGc9GK

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: MapViewOfSection 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:420
    • C:\Windows\system32\csrss.exe
      %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
      1⤵
        PID:384
      • C:\Windows\system32\wininit.exe
        wininit.exe
        1⤵
          PID:372
          • C:\Windows\system32\services.exe
            C:\Windows\system32\services.exe
            2⤵
              PID:468
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
                3⤵
                  PID:1036
                • C:\Windows\system32\sppsvc.exe
                  C:\Windows\system32\sppsvc.exe
                  3⤵
                    PID:2364
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
                    3⤵
                      PID:2336
                    • C:\Windows\system32\taskhost.exe
                      "taskhost.exe"
                      3⤵
                        PID:1124
                      • C:\Windows\System32\spoolsv.exe
                        C:\Windows\System32\spoolsv.exe
                        3⤵
                          PID:328
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k NetworkService
                          3⤵
                            PID:276
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalService
                            3⤵
                              PID:968
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k netsvcs
                              3⤵
                                PID:848
                              • C:\Windows\System32\svchost.exe
                                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
                                3⤵
                                  PID:816
                                • C:\Windows\System32\svchost.exe
                                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
                                  3⤵
                                    PID:764
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k RPCSS
                                    3⤵
                                      PID:680
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k DcomLaunch
                                      3⤵
                                        PID:596
                                    • C:\Windows\system32\lsass.exe
                                      C:\Windows\system32\lsass.exe
                                      2⤵
                                        PID:476
                                      • C:\Windows\system32\lsm.exe
                                        C:\Windows\system32\lsm.exe
                                        2⤵
                                          PID:484
                                      • C:\Windows\Explorer.EXE
                                        C:\Windows\Explorer.EXE
                                        1⤵
                                          PID:1260
                                          • C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe
                                            "C:\Users\Admin\AppData\Local\Temp\ac4ed2f45c49db9b1cd0fd7bb9ad241c.exe"
                                            2⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious behavior: MapViewOfSection
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of WriteProcessMemory
                                            PID:2040
                                        • C:\Windows\system32\DllHost.exe
                                          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                          1⤵
                                            PID:2016
                                          • C:\Windows\system32\Dwm.exe
                                            "C:\Windows\system32\Dwm.exe"
                                            1⤵
                                              PID:1172

                                            Network

                                                  MITRE ATT&CK Matrix

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  • memory/2040-0-0x0000000000400000-0x000000000041B000-memory.dmp

                                                    Filesize

                                                    108KB

                                                  • memory/2040-1-0x0000000077A2F000-0x0000000077A30000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/2040-2-0x0000000077A30000-0x0000000077A31000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/2040-3-0x0000000000400000-0x000000000041B000-memory.dmp

                                                    Filesize

                                                    108KB