0e9b0f7bb7d08267cd70e084f94e712f7c05a41a94ed6e2e240bd5f89bb80c5d

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
18-01-2024 00:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63ff023599d75a7d6d502fffc09e2863.exe
Size

50KB
MD5

63ff023599d75a7d6d502fffc09e2863
SHA1

a29693e80be7373b2ebf5aa8c0d1cdc2bb5eafca
SHA256

0e9b0f7bb7d08267cd70e084f94e712f7c05a41a94ed6e2e240bd5f89bb80c5d
SHA512

42fa932e6b5109ec74ad71512d2310f3e9517e2ae01e433e277693031466bcd3403368b8dd7dbb8655a6ab692e6766d0473d64f2574adc3add2918ebda034dbe
SSDEEP

768:TLKMpusnGNFjNCS1d5ak6qQbe99xsc/8xNDEB3jegwgmbO:TEsnbEhMe7xD8DDE5en9bO

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1460	63ff023599d75a7d6d502fffc09e2863.exe

Suspicious behavior: MapViewOfSection 22 IoCs

pid	Process
1460	63ff023599d75a7d6d502fffc09e2863.exe
1460	63ff023599d75a7d6d502fffc09e2863.exe
1460	63ff023599d75a7d6d502fffc09e2863.exe
1460	63ff023599d75a7d6d502fffc09e2863.exe
1460	63ff023599d75a7d6d502fffc09e2863.exe
1460	63ff023599d75a7d6d502fffc09e2863.exe
1460	63ff023599d75a7d6d502fffc09e2863.exe
1460	63ff023599d75a7d6d502fffc09e2863.exe
1460	63ff023599d75a7d6d502fffc09e2863.exe
1460	63ff023599d75a7d6d502fffc09e2863.exe
1460	63ff023599d75a7d6d502fffc09e2863.exe
1460	63ff023599d75a7d6d502fffc09e2863.exe
1460	63ff023599d75a7d6d502fffc09e2863.exe
1460	63ff023599d75a7d6d502fffc09e2863.exe
1460	63ff023599d75a7d6d502fffc09e2863.exe
1460	63ff023599d75a7d6d502fffc09e2863.exe
1460	63ff023599d75a7d6d502fffc09e2863.exe
1460	63ff023599d75a7d6d502fffc09e2863.exe
1460	63ff023599d75a7d6d502fffc09e2863.exe
1460	63ff023599d75a7d6d502fffc09e2863.exe
1460	63ff023599d75a7d6d502fffc09e2863.exe
1460	63ff023599d75a7d6d502fffc09e2863.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1460	63ff023599d75a7d6d502fffc09e2863.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 388	1460	63ff023599d75a7d6d502fffc09e2863.exe	26
PID 1460 wrote to memory of 388	1460	63ff023599d75a7d6d502fffc09e2863.exe	26
PID 1460 wrote to memory of 388	1460	63ff023599d75a7d6d502fffc09e2863.exe	26
PID 1460 wrote to memory of 388	1460	63ff023599d75a7d6d502fffc09e2863.exe	26
PID 1460 wrote to memory of 388	1460	63ff023599d75a7d6d502fffc09e2863.exe	26
PID 1460 wrote to memory of 388	1460	63ff023599d75a7d6d502fffc09e2863.exe	26
PID 1460 wrote to memory of 388	1460	63ff023599d75a7d6d502fffc09e2863.exe	26
PID 1460 wrote to memory of 400	1460	63ff023599d75a7d6d502fffc09e2863.exe	25
PID 1460 wrote to memory of 400	1460	63ff023599d75a7d6d502fffc09e2863.exe	25
PID 1460 wrote to memory of 400	1460	63ff023599d75a7d6d502fffc09e2863.exe	25
PID 1460 wrote to memory of 400	1460	63ff023599d75a7d6d502fffc09e2863.exe	25
PID 1460 wrote to memory of 400	1460	63ff023599d75a7d6d502fffc09e2863.exe	25
PID 1460 wrote to memory of 400	1460	63ff023599d75a7d6d502fffc09e2863.exe	25
PID 1460 wrote to memory of 400	1460	63ff023599d75a7d6d502fffc09e2863.exe	25
PID 1460 wrote to memory of 436	1460	63ff023599d75a7d6d502fffc09e2863.exe	24
PID 1460 wrote to memory of 436	1460	63ff023599d75a7d6d502fffc09e2863.exe	24
PID 1460 wrote to memory of 436	1460	63ff023599d75a7d6d502fffc09e2863.exe	24
PID 1460 wrote to memory of 436	1460	63ff023599d75a7d6d502fffc09e2863.exe	24
PID 1460 wrote to memory of 436	1460	63ff023599d75a7d6d502fffc09e2863.exe	24
PID 1460 wrote to memory of 436	1460	63ff023599d75a7d6d502fffc09e2863.exe	24
PID 1460 wrote to memory of 436	1460	63ff023599d75a7d6d502fffc09e2863.exe	24
PID 1460 wrote to memory of 480	1460	63ff023599d75a7d6d502fffc09e2863.exe	23
PID 1460 wrote to memory of 480	1460	63ff023599d75a7d6d502fffc09e2863.exe	23
PID 1460 wrote to memory of 480	1460	63ff023599d75a7d6d502fffc09e2863.exe	23
PID 1460 wrote to memory of 480	1460	63ff023599d75a7d6d502fffc09e2863.exe	23
PID 1460 wrote to memory of 480	1460	63ff023599d75a7d6d502fffc09e2863.exe	23
PID 1460 wrote to memory of 480	1460	63ff023599d75a7d6d502fffc09e2863.exe	23
PID 1460 wrote to memory of 480	1460	63ff023599d75a7d6d502fffc09e2863.exe	23
PID 1460 wrote to memory of 496	1460	63ff023599d75a7d6d502fffc09e2863.exe	22
PID 1460 wrote to memory of 496	1460	63ff023599d75a7d6d502fffc09e2863.exe	22
PID 1460 wrote to memory of 496	1460	63ff023599d75a7d6d502fffc09e2863.exe	22
PID 1460 wrote to memory of 496	1460	63ff023599d75a7d6d502fffc09e2863.exe	22
PID 1460 wrote to memory of 496	1460	63ff023599d75a7d6d502fffc09e2863.exe	22
PID 1460 wrote to memory of 496	1460	63ff023599d75a7d6d502fffc09e2863.exe	22
PID 1460 wrote to memory of 496	1460	63ff023599d75a7d6d502fffc09e2863.exe	22
PID 1460 wrote to memory of 504	1460	63ff023599d75a7d6d502fffc09e2863.exe	21
PID 1460 wrote to memory of 504	1460	63ff023599d75a7d6d502fffc09e2863.exe	21
PID 1460 wrote to memory of 504	1460	63ff023599d75a7d6d502fffc09e2863.exe	21
PID 1460 wrote to memory of 504	1460	63ff023599d75a7d6d502fffc09e2863.exe	21
PID 1460 wrote to memory of 504	1460	63ff023599d75a7d6d502fffc09e2863.exe	21
PID 1460 wrote to memory of 504	1460	63ff023599d75a7d6d502fffc09e2863.exe	21
PID 1460 wrote to memory of 504	1460	63ff023599d75a7d6d502fffc09e2863.exe	21
PID 1460 wrote to memory of 616	1460	63ff023599d75a7d6d502fffc09e2863.exe	20
PID 1460 wrote to memory of 616	1460	63ff023599d75a7d6d502fffc09e2863.exe	20
PID 1460 wrote to memory of 616	1460	63ff023599d75a7d6d502fffc09e2863.exe	20
PID 1460 wrote to memory of 616	1460	63ff023599d75a7d6d502fffc09e2863.exe	20
PID 1460 wrote to memory of 616	1460	63ff023599d75a7d6d502fffc09e2863.exe	20
PID 1460 wrote to memory of 616	1460	63ff023599d75a7d6d502fffc09e2863.exe	20
PID 1460 wrote to memory of 616	1460	63ff023599d75a7d6d502fffc09e2863.exe	20
PID 1460 wrote to memory of 684	1460	63ff023599d75a7d6d502fffc09e2863.exe	19
PID 1460 wrote to memory of 684	1460	63ff023599d75a7d6d502fffc09e2863.exe	19
PID 1460 wrote to memory of 684	1460	63ff023599d75a7d6d502fffc09e2863.exe	19
PID 1460 wrote to memory of 684	1460	63ff023599d75a7d6d502fffc09e2863.exe	19
PID 1460 wrote to memory of 684	1460	63ff023599d75a7d6d502fffc09e2863.exe	19
PID 1460 wrote to memory of 684	1460	63ff023599d75a7d6d502fffc09e2863.exe	19
PID 1460 wrote to memory of 684	1460	63ff023599d75a7d6d502fffc09e2863.exe	19
PID 1460 wrote to memory of 768	1460	63ff023599d75a7d6d502fffc09e2863.exe	18
PID 1460 wrote to memory of 768	1460	63ff023599d75a7d6d502fffc09e2863.exe	18
PID 1460 wrote to memory of 768	1460	63ff023599d75a7d6d502fffc09e2863.exe	18
PID 1460 wrote to memory of 768	1460	63ff023599d75a7d6d502fffc09e2863.exe	18
PID 1460 wrote to memory of 768	1460	63ff023599d75a7d6d502fffc09e2863.exe	18
PID 1460 wrote to memory of 768	1460	63ff023599d75a7d6d502fffc09e2863.exe	18
PID 1460 wrote to memory of 768	1460	63ff023599d75a7d6d502fffc09e2863.exe	18
PID 1460 wrote to memory of 832	1460	63ff023599d75a7d6d502fffc09e2863.exe	17

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
1⤵
PID:2108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
1⤵
PID:2268

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1980

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1352
- C:\Users\Admin\AppData\Local\Temp\63ff023599d75a7d6d502fffc09e2863.exe
  "C:\Users\Admin\AppData\Local\Temp\63ff023599d75a7d6d502fffc09e2863.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1460

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1320

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
1⤵
PID:1040

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
1⤵
PID:356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
1⤵
PID:1012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:860

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-307912861662357661788481649-78356356578615999-34985624715278948-158878865"
1⤵
PID:1108

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
1⤵
PID:832

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
1⤵
PID:684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
1⤵
PID:616

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:504

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:496

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:480

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:436

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:400

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1460-0-0x0000000001000000-0x000000000100F000-memory.dmp

Filesize
60KB

Download
memory/1460-2-0x0000000077AD0000-0x0000000077AD1000-memory.dmp

Filesize
4KB

Download
memory/1460-1-0x0000000077ACF000-0x0000000077AD0000-memory.dmp

Filesize
4KB

Download
memory/1460-3-0x0000000001000000-0x000000000100F000-memory.dmp

Filesize
60KB

Download