847ef10c07b0ec79eea589b191fde4df07e8603268cb64e67682fa005a03b63b

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 19:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

57441c60285bb26d83ba268d79994c53.exe
Size

126KB
MD5

57441c60285bb26d83ba268d79994c53
SHA1

8da39cd27a4a35c297139ef871874bdb9c14eae2
SHA256

847ef10c07b0ec79eea589b191fde4df07e8603268cb64e67682fa005a03b63b
SHA512

b1152041384ff5d28da0a1a6d836d4d516b6affeb1e8cfcdce17b3973a33ba9208d8319b9821ea33b0aed3570929f84f66ff9301c9129eb980dfd3693297da91
SSDEEP

3072:PHbuq0/DPwCGPo9St8WHxSD+09+S+OstPadWe:P7u5cf8CA0S+RtC

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2540	57441c60285bb26d83ba268d79994c53.exe

Suspicious behavior: MapViewOfSection 21 IoCs

pid	Process
2540	57441c60285bb26d83ba268d79994c53.exe
2540	57441c60285bb26d83ba268d79994c53.exe
2540	57441c60285bb26d83ba268d79994c53.exe
2540	57441c60285bb26d83ba268d79994c53.exe
2540	57441c60285bb26d83ba268d79994c53.exe
2540	57441c60285bb26d83ba268d79994c53.exe
2540	57441c60285bb26d83ba268d79994c53.exe
2540	57441c60285bb26d83ba268d79994c53.exe
2540	57441c60285bb26d83ba268d79994c53.exe
2540	57441c60285bb26d83ba268d79994c53.exe
2540	57441c60285bb26d83ba268d79994c53.exe
2540	57441c60285bb26d83ba268d79994c53.exe
2540	57441c60285bb26d83ba268d79994c53.exe
2540	57441c60285bb26d83ba268d79994c53.exe
2540	57441c60285bb26d83ba268d79994c53.exe
2540	57441c60285bb26d83ba268d79994c53.exe
2540	57441c60285bb26d83ba268d79994c53.exe
2540	57441c60285bb26d83ba268d79994c53.exe
2540	57441c60285bb26d83ba268d79994c53.exe
2540	57441c60285bb26d83ba268d79994c53.exe
2540	57441c60285bb26d83ba268d79994c53.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2540	57441c60285bb26d83ba268d79994c53.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 372	2540	57441c60285bb26d83ba268d79994c53.exe	25
PID 2540 wrote to memory of 372	2540	57441c60285bb26d83ba268d79994c53.exe	25
PID 2540 wrote to memory of 372	2540	57441c60285bb26d83ba268d79994c53.exe	25
PID 2540 wrote to memory of 372	2540	57441c60285bb26d83ba268d79994c53.exe	25
PID 2540 wrote to memory of 372	2540	57441c60285bb26d83ba268d79994c53.exe	25
PID 2540 wrote to memory of 372	2540	57441c60285bb26d83ba268d79994c53.exe	25
PID 2540 wrote to memory of 372	2540	57441c60285bb26d83ba268d79994c53.exe	25
PID 2540 wrote to memory of 384	2540	57441c60285bb26d83ba268d79994c53.exe	24
PID 2540 wrote to memory of 384	2540	57441c60285bb26d83ba268d79994c53.exe	24
PID 2540 wrote to memory of 384	2540	57441c60285bb26d83ba268d79994c53.exe	24
PID 2540 wrote to memory of 384	2540	57441c60285bb26d83ba268d79994c53.exe	24
PID 2540 wrote to memory of 384	2540	57441c60285bb26d83ba268d79994c53.exe	24
PID 2540 wrote to memory of 384	2540	57441c60285bb26d83ba268d79994c53.exe	24
PID 2540 wrote to memory of 384	2540	57441c60285bb26d83ba268d79994c53.exe	24
PID 2540 wrote to memory of 420	2540	57441c60285bb26d83ba268d79994c53.exe	3
PID 2540 wrote to memory of 420	2540	57441c60285bb26d83ba268d79994c53.exe	3
PID 2540 wrote to memory of 420	2540	57441c60285bb26d83ba268d79994c53.exe	3
PID 2540 wrote to memory of 420	2540	57441c60285bb26d83ba268d79994c53.exe	3
PID 2540 wrote to memory of 420	2540	57441c60285bb26d83ba268d79994c53.exe	3
PID 2540 wrote to memory of 420	2540	57441c60285bb26d83ba268d79994c53.exe	3
PID 2540 wrote to memory of 420	2540	57441c60285bb26d83ba268d79994c53.exe	3
PID 2540 wrote to memory of 464	2540	57441c60285bb26d83ba268d79994c53.exe	2
PID 2540 wrote to memory of 464	2540	57441c60285bb26d83ba268d79994c53.exe	2
PID 2540 wrote to memory of 464	2540	57441c60285bb26d83ba268d79994c53.exe	2
PID 2540 wrote to memory of 464	2540	57441c60285bb26d83ba268d79994c53.exe	2
PID 2540 wrote to memory of 464	2540	57441c60285bb26d83ba268d79994c53.exe	2
PID 2540 wrote to memory of 464	2540	57441c60285bb26d83ba268d79994c53.exe	2
PID 2540 wrote to memory of 464	2540	57441c60285bb26d83ba268d79994c53.exe	2
PID 2540 wrote to memory of 480	2540	57441c60285bb26d83ba268d79994c53.exe	1
PID 2540 wrote to memory of 480	2540	57441c60285bb26d83ba268d79994c53.exe	1
PID 2540 wrote to memory of 480	2540	57441c60285bb26d83ba268d79994c53.exe	1
PID 2540 wrote to memory of 480	2540	57441c60285bb26d83ba268d79994c53.exe	1
PID 2540 wrote to memory of 480	2540	57441c60285bb26d83ba268d79994c53.exe	1
PID 2540 wrote to memory of 480	2540	57441c60285bb26d83ba268d79994c53.exe	1
PID 2540 wrote to memory of 480	2540	57441c60285bb26d83ba268d79994c53.exe	1
PID 2540 wrote to memory of 488	2540	57441c60285bb26d83ba268d79994c53.exe	23
PID 2540 wrote to memory of 488	2540	57441c60285bb26d83ba268d79994c53.exe	23
PID 2540 wrote to memory of 488	2540	57441c60285bb26d83ba268d79994c53.exe	23
PID 2540 wrote to memory of 488	2540	57441c60285bb26d83ba268d79994c53.exe	23
PID 2540 wrote to memory of 488	2540	57441c60285bb26d83ba268d79994c53.exe	23
PID 2540 wrote to memory of 488	2540	57441c60285bb26d83ba268d79994c53.exe	23
PID 2540 wrote to memory of 488	2540	57441c60285bb26d83ba268d79994c53.exe	23
PID 2540 wrote to memory of 580	2540	57441c60285bb26d83ba268d79994c53.exe	22
PID 2540 wrote to memory of 580	2540	57441c60285bb26d83ba268d79994c53.exe	22
PID 2540 wrote to memory of 580	2540	57441c60285bb26d83ba268d79994c53.exe	22
PID 2540 wrote to memory of 580	2540	57441c60285bb26d83ba268d79994c53.exe	22
PID 2540 wrote to memory of 580	2540	57441c60285bb26d83ba268d79994c53.exe	22
PID 2540 wrote to memory of 580	2540	57441c60285bb26d83ba268d79994c53.exe	22
PID 2540 wrote to memory of 580	2540	57441c60285bb26d83ba268d79994c53.exe	22
PID 2540 wrote to memory of 660	2540	57441c60285bb26d83ba268d79994c53.exe	21
PID 2540 wrote to memory of 660	2540	57441c60285bb26d83ba268d79994c53.exe	21
PID 2540 wrote to memory of 660	2540	57441c60285bb26d83ba268d79994c53.exe	21
PID 2540 wrote to memory of 660	2540	57441c60285bb26d83ba268d79994c53.exe	21
PID 2540 wrote to memory of 660	2540	57441c60285bb26d83ba268d79994c53.exe	21
PID 2540 wrote to memory of 660	2540	57441c60285bb26d83ba268d79994c53.exe	21
PID 2540 wrote to memory of 660	2540	57441c60285bb26d83ba268d79994c53.exe	21
PID 2540 wrote to memory of 748	2540	57441c60285bb26d83ba268d79994c53.exe	20
PID 2540 wrote to memory of 748	2540	57441c60285bb26d83ba268d79994c53.exe	20
PID 2540 wrote to memory of 748	2540	57441c60285bb26d83ba268d79994c53.exe	20
PID 2540 wrote to memory of 748	2540	57441c60285bb26d83ba268d79994c53.exe	20
PID 2540 wrote to memory of 748	2540	57441c60285bb26d83ba268d79994c53.exe	20
PID 2540 wrote to memory of 748	2540	57441c60285bb26d83ba268d79994c53.exe	20
PID 2540 wrote to memory of 748	2540	57441c60285bb26d83ba268d79994c53.exe	20
PID 2540 wrote to memory of 800	2540	57441c60285bb26d83ba268d79994c53.exe	19

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:480

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:464
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:824
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:2340
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:2376
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1108
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1040
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:1000
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:112
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:948
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:800
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:748
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:660
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:580
- - C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
    3⤵
    PID:2772

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1236
- C:\Users\Admin\AppData\Local\Temp\57441c60285bb26d83ba268d79994c53.exe
  "C:\Users\Admin\AppData\Local\Temp\57441c60285bb26d83ba268d79994c53.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2540

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1628

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1176

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:488

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:384

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2540-0-0x0000000001000000-0x0000000001024000-memory.dmp

Filesize
144KB

Download
memory/2540-2-0x0000000077BE0000-0x0000000077BE1000-memory.dmp

Filesize
4KB

Download
memory/2540-1-0x0000000077BDF000-0x0000000077BE0000-memory.dmp

Filesize
4KB

Download
memory/2540-3-0x0000000001000000-0x0000000001024000-memory.dmp

Filesize
144KB

Download