b1d9f75274c73dc9a9355c98cbec81f28452bf3df89d9558fd38b07eaf027de9

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12-01-2024 18:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

57262f1ad806295ea648451d3ed4748c.exe
Size

72KB
MD5

57262f1ad806295ea648451d3ed4748c
SHA1

94e6f9124aaa1f57bada3123d385de41db450350
SHA256

b1d9f75274c73dc9a9355c98cbec81f28452bf3df89d9558fd38b07eaf027de9
SHA512

eb09704c459eb6f1fc4d93768ee7bc9dc215ffa317e0e1fa5140906cec93a9103e6880a08db45a41d732c7365fd2ddbda04f459657808774b0a119ef37b6b210
SSDEEP

768:4P0xTX9xTXtwKLQKDmibTmiYpXNAO/1Mhx5IvuAOm1lcJlhLxtaR06zEi3xkyLOL:rmijx+vxvcJlhxtaRsizOSA1kDTQu1

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2932	57262f1ad806295ea648451d3ed4748c.exe

Suspicious behavior: MapViewOfSection 21 IoCs

pid	Process
2932	57262f1ad806295ea648451d3ed4748c.exe
2932	57262f1ad806295ea648451d3ed4748c.exe
2932	57262f1ad806295ea648451d3ed4748c.exe
2932	57262f1ad806295ea648451d3ed4748c.exe
2932	57262f1ad806295ea648451d3ed4748c.exe
2932	57262f1ad806295ea648451d3ed4748c.exe
2932	57262f1ad806295ea648451d3ed4748c.exe
2932	57262f1ad806295ea648451d3ed4748c.exe
2932	57262f1ad806295ea648451d3ed4748c.exe
2932	57262f1ad806295ea648451d3ed4748c.exe
2932	57262f1ad806295ea648451d3ed4748c.exe
2932	57262f1ad806295ea648451d3ed4748c.exe
2932	57262f1ad806295ea648451d3ed4748c.exe
2932	57262f1ad806295ea648451d3ed4748c.exe
2932	57262f1ad806295ea648451d3ed4748c.exe
2932	57262f1ad806295ea648451d3ed4748c.exe
2932	57262f1ad806295ea648451d3ed4748c.exe
2932	57262f1ad806295ea648451d3ed4748c.exe
2932	57262f1ad806295ea648451d3ed4748c.exe
2932	57262f1ad806295ea648451d3ed4748c.exe
2932	57262f1ad806295ea648451d3ed4748c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2932	57262f1ad806295ea648451d3ed4748c.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2932	57262f1ad806295ea648451d3ed4748c.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 388	2932	57262f1ad806295ea648451d3ed4748c.exe	25
PID 2932 wrote to memory of 388	2932	57262f1ad806295ea648451d3ed4748c.exe	25
PID 2932 wrote to memory of 388	2932	57262f1ad806295ea648451d3ed4748c.exe	25
PID 2932 wrote to memory of 388	2932	57262f1ad806295ea648451d3ed4748c.exe	25
PID 2932 wrote to memory of 388	2932	57262f1ad806295ea648451d3ed4748c.exe	25
PID 2932 wrote to memory of 388	2932	57262f1ad806295ea648451d3ed4748c.exe	25
PID 2932 wrote to memory of 388	2932	57262f1ad806295ea648451d3ed4748c.exe	25
PID 2932 wrote to memory of 400	2932	57262f1ad806295ea648451d3ed4748c.exe	24
PID 2932 wrote to memory of 400	2932	57262f1ad806295ea648451d3ed4748c.exe	24
PID 2932 wrote to memory of 400	2932	57262f1ad806295ea648451d3ed4748c.exe	24
PID 2932 wrote to memory of 400	2932	57262f1ad806295ea648451d3ed4748c.exe	24
PID 2932 wrote to memory of 400	2932	57262f1ad806295ea648451d3ed4748c.exe	24
PID 2932 wrote to memory of 400	2932	57262f1ad806295ea648451d3ed4748c.exe	24
PID 2932 wrote to memory of 400	2932	57262f1ad806295ea648451d3ed4748c.exe	24
PID 2932 wrote to memory of 436	2932	57262f1ad806295ea648451d3ed4748c.exe	23
PID 2932 wrote to memory of 436	2932	57262f1ad806295ea648451d3ed4748c.exe	23
PID 2932 wrote to memory of 436	2932	57262f1ad806295ea648451d3ed4748c.exe	23
PID 2932 wrote to memory of 436	2932	57262f1ad806295ea648451d3ed4748c.exe	23
PID 2932 wrote to memory of 436	2932	57262f1ad806295ea648451d3ed4748c.exe	23
PID 2932 wrote to memory of 436	2932	57262f1ad806295ea648451d3ed4748c.exe	23
PID 2932 wrote to memory of 436	2932	57262f1ad806295ea648451d3ed4748c.exe	23
PID 2932 wrote to memory of 480	2932	57262f1ad806295ea648451d3ed4748c.exe	22
PID 2932 wrote to memory of 480	2932	57262f1ad806295ea648451d3ed4748c.exe	22
PID 2932 wrote to memory of 480	2932	57262f1ad806295ea648451d3ed4748c.exe	22
PID 2932 wrote to memory of 480	2932	57262f1ad806295ea648451d3ed4748c.exe	22
PID 2932 wrote to memory of 480	2932	57262f1ad806295ea648451d3ed4748c.exe	22
PID 2932 wrote to memory of 480	2932	57262f1ad806295ea648451d3ed4748c.exe	22
PID 2932 wrote to memory of 480	2932	57262f1ad806295ea648451d3ed4748c.exe	22
PID 2932 wrote to memory of 496	2932	57262f1ad806295ea648451d3ed4748c.exe	21
PID 2932 wrote to memory of 496	2932	57262f1ad806295ea648451d3ed4748c.exe	21
PID 2932 wrote to memory of 496	2932	57262f1ad806295ea648451d3ed4748c.exe	21
PID 2932 wrote to memory of 496	2932	57262f1ad806295ea648451d3ed4748c.exe	21
PID 2932 wrote to memory of 496	2932	57262f1ad806295ea648451d3ed4748c.exe	21
PID 2932 wrote to memory of 496	2932	57262f1ad806295ea648451d3ed4748c.exe	21
PID 2932 wrote to memory of 496	2932	57262f1ad806295ea648451d3ed4748c.exe	21
PID 2932 wrote to memory of 504	2932	57262f1ad806295ea648451d3ed4748c.exe	20
PID 2932 wrote to memory of 504	2932	57262f1ad806295ea648451d3ed4748c.exe	20
PID 2932 wrote to memory of 504	2932	57262f1ad806295ea648451d3ed4748c.exe	20
PID 2932 wrote to memory of 504	2932	57262f1ad806295ea648451d3ed4748c.exe	20
PID 2932 wrote to memory of 504	2932	57262f1ad806295ea648451d3ed4748c.exe	20
PID 2932 wrote to memory of 504	2932	57262f1ad806295ea648451d3ed4748c.exe	20
PID 2932 wrote to memory of 504	2932	57262f1ad806295ea648451d3ed4748c.exe	20
PID 2932 wrote to memory of 596	2932	57262f1ad806295ea648451d3ed4748c.exe	19
PID 2932 wrote to memory of 596	2932	57262f1ad806295ea648451d3ed4748c.exe	19
PID 2932 wrote to memory of 596	2932	57262f1ad806295ea648451d3ed4748c.exe	19
PID 2932 wrote to memory of 596	2932	57262f1ad806295ea648451d3ed4748c.exe	19
PID 2932 wrote to memory of 596	2932	57262f1ad806295ea648451d3ed4748c.exe	19
PID 2932 wrote to memory of 596	2932	57262f1ad806295ea648451d3ed4748c.exe	19
PID 2932 wrote to memory of 596	2932	57262f1ad806295ea648451d3ed4748c.exe	19
PID 2932 wrote to memory of 680	2932	57262f1ad806295ea648451d3ed4748c.exe	18
PID 2932 wrote to memory of 680	2932	57262f1ad806295ea648451d3ed4748c.exe	18
PID 2932 wrote to memory of 680	2932	57262f1ad806295ea648451d3ed4748c.exe	18
PID 2932 wrote to memory of 680	2932	57262f1ad806295ea648451d3ed4748c.exe	18
PID 2932 wrote to memory of 680	2932	57262f1ad806295ea648451d3ed4748c.exe	18
PID 2932 wrote to memory of 680	2932	57262f1ad806295ea648451d3ed4748c.exe	18
PID 2932 wrote to memory of 680	2932	57262f1ad806295ea648451d3ed4748c.exe	18
PID 2932 wrote to memory of 756	2932	57262f1ad806295ea648451d3ed4748c.exe	17
PID 2932 wrote to memory of 756	2932	57262f1ad806295ea648451d3ed4748c.exe	17
PID 2932 wrote to memory of 756	2932	57262f1ad806295ea648451d3ed4748c.exe	17
PID 2932 wrote to memory of 756	2932	57262f1ad806295ea648451d3ed4748c.exe	17
PID 2932 wrote to memory of 756	2932	57262f1ad806295ea648451d3ed4748c.exe	17
PID 2932 wrote to memory of 756	2932	57262f1ad806295ea648451d3ed4748c.exe	17
PID 2932 wrote to memory of 756	2932	57262f1ad806295ea648451d3ed4748c.exe	17
PID 2932 wrote to memory of 824	2932	57262f1ad806295ea648451d3ed4748c.exe	15

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
1⤵
PID:3036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
1⤵
PID:2144

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2200

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1192
- C:\Users\Admin\AppData\Local\Temp\57262f1ad806295ea648451d3ed4748c.exe
  "C:\Users\Admin\AppData\Local\Temp\57262f1ad806295ea648451d3ed4748c.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2932

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1168

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
1⤵
PID:1108

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1076

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
1⤵
PID:304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
1⤵
PID:992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:864

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
1⤵
PID:824

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
1⤵
PID:680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
1⤵
PID:596

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:504

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:496

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:480

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:436

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:400

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2932-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2932-2-0x0000000077E0F000-0x0000000077E10000-memory.dmp

Filesize
4KB

Download
memory/2932-3-0x0000000077E10000-0x0000000077E11000-memory.dmp

Filesize
4KB

Download
memory/2932-5-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download