c0a23e91bce181ee5d97710e386f652839b529a995c73400a891ac36ce0c0743

Analysis

max time kernel
137s
max time network
3s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-01-2024 21:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7860c0db8475799a04976b2d4f063e7a.exe
Size

45KB
MD5

7860c0db8475799a04976b2d4f063e7a
SHA1

6d0e54f4c05c1247e9cdb41f284a35c24dd04b6d
SHA256

c0a23e91bce181ee5d97710e386f652839b529a995c73400a891ac36ce0c0743
SHA512

22591f998efa75da7680069bcd241cf6c50e1f009783a6432fa4b73ab19c11b57b7cceb9b0318b026f3da43c347998e8d6c3ec2dab73ab4b40b57522361d37da
SSDEEP

768:qGaisbJ4rI04zl+p6rlqxu1UTK3S2B3DYU02RPKK2zvO1GvJUT1WRyqLdhVl:taisWrINl+pWlqxu1UTK3S2B3DYtuPKl

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2848	cmd.exe

Executes dropped EXE 5 IoCs

pid	Process
2768	7860c0db8475799a04976b2d4f063e7a.exe
2480	7860c0db8475799a04976b2d4f063e7a.exe
2724	7860c0db8475799a04976b2d4f063e7a.exe
2984	7860c0db8475799a04976b2d4f063e7a.exe
2748	7860c0db8475799a04976b2d4f063e7a.exe

Loads dropped DLL 10 IoCs

pid	Process
2344	7860c0db8475799a04976b2d4f063e7a.exe
2344	7860c0db8475799a04976b2d4f063e7a.exe
2768	7860c0db8475799a04976b2d4f063e7a.exe
2768	7860c0db8475799a04976b2d4f063e7a.exe
2480	7860c0db8475799a04976b2d4f063e7a.exe
2480	7860c0db8475799a04976b2d4f063e7a.exe
2724	7860c0db8475799a04976b2d4f063e7a.exe
2724	7860c0db8475799a04976b2d4f063e7a.exe
2984	7860c0db8475799a04976b2d4f063e7a.exe
2984	7860c0db8475799a04976b2d4f063e7a.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\7860c0db8475799a04976b2d4f063e7a.exe	7860c0db8475799a04976b2d4f063e7a.exe
File opened for modification	C:\Windows\SysWOW64\7860c0db8475799a04976b2d4f063e7a.exe	7860c0db8475799a04976b2d4f063e7a.exe
File created	C:\Windows\SysWOW64\7860c0db8475799a04976b2d4f063e7a.exe	7860c0db8475799a04976b2d4f063e7a.exe
File created	C:\Windows\SysWOW64\7860c0db8475799a04976b2d4f063e7a.exe	7860c0db8475799a04976b2d4f063e7a.exe
File created	C:\Windows\SysWOW64\7860c0db8475799a04976b2d4f063e7a.exe	7860c0db8475799a04976b2d4f063e7a.exe
File created	C:\Windows\SysWOW64\7860c0db8475799a04976b2d4f063e7a.exe	7860c0db8475799a04976b2d4f063e7a.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2344	7860c0db8475799a04976b2d4f063e7a.exe
Token: SeIncBasePriorityPrivilege	2768	7860c0db8475799a04976b2d4f063e7a.exe
Token: SeIncBasePriorityPrivilege	2480	7860c0db8475799a04976b2d4f063e7a.exe
Token: SeIncBasePriorityPrivilege	2724	7860c0db8475799a04976b2d4f063e7a.exe
Token: SeIncBasePriorityPrivilege	2984	7860c0db8475799a04976b2d4f063e7a.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2344	7860c0db8475799a04976b2d4f063e7a.exe
2344	7860c0db8475799a04976b2d4f063e7a.exe
2768	7860c0db8475799a04976b2d4f063e7a.exe
2768	7860c0db8475799a04976b2d4f063e7a.exe
2480	7860c0db8475799a04976b2d4f063e7a.exe
2480	7860c0db8475799a04976b2d4f063e7a.exe
2724	7860c0db8475799a04976b2d4f063e7a.exe
2724	7860c0db8475799a04976b2d4f063e7a.exe
2984	7860c0db8475799a04976b2d4f063e7a.exe
2984	7860c0db8475799a04976b2d4f063e7a.exe
2748	7860c0db8475799a04976b2d4f063e7a.exe
2748	7860c0db8475799a04976b2d4f063e7a.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 2768	2344	7860c0db8475799a04976b2d4f063e7a.exe	28
PID 2344 wrote to memory of 2768	2344	7860c0db8475799a04976b2d4f063e7a.exe	28
PID 2344 wrote to memory of 2768	2344	7860c0db8475799a04976b2d4f063e7a.exe	28
PID 2344 wrote to memory of 2768	2344	7860c0db8475799a04976b2d4f063e7a.exe	28
PID 2768 wrote to memory of 2480	2768	7860c0db8475799a04976b2d4f063e7a.exe	32
PID 2768 wrote to memory of 2480	2768	7860c0db8475799a04976b2d4f063e7a.exe	32
PID 2768 wrote to memory of 2480	2768	7860c0db8475799a04976b2d4f063e7a.exe	32
PID 2768 wrote to memory of 2480	2768	7860c0db8475799a04976b2d4f063e7a.exe	32
PID 2344 wrote to memory of 2848	2344	7860c0db8475799a04976b2d4f063e7a.exe	29
PID 2344 wrote to memory of 2848	2344	7860c0db8475799a04976b2d4f063e7a.exe	29
PID 2344 wrote to memory of 2848	2344	7860c0db8475799a04976b2d4f063e7a.exe	29
PID 2344 wrote to memory of 2848	2344	7860c0db8475799a04976b2d4f063e7a.exe	29
PID 2480 wrote to memory of 2724	2480	7860c0db8475799a04976b2d4f063e7a.exe	30
PID 2480 wrote to memory of 2724	2480	7860c0db8475799a04976b2d4f063e7a.exe	30
PID 2480 wrote to memory of 2724	2480	7860c0db8475799a04976b2d4f063e7a.exe	30
PID 2480 wrote to memory of 2724	2480	7860c0db8475799a04976b2d4f063e7a.exe	30
PID 2768 wrote to memory of 2836	2768	7860c0db8475799a04976b2d4f063e7a.exe	31
PID 2768 wrote to memory of 2836	2768	7860c0db8475799a04976b2d4f063e7a.exe	31
PID 2768 wrote to memory of 2836	2768	7860c0db8475799a04976b2d4f063e7a.exe	31
PID 2768 wrote to memory of 2836	2768	7860c0db8475799a04976b2d4f063e7a.exe	31
PID 2480 wrote to memory of 2740	2480	7860c0db8475799a04976b2d4f063e7a.exe	34
PID 2480 wrote to memory of 2740	2480	7860c0db8475799a04976b2d4f063e7a.exe	34
PID 2480 wrote to memory of 2740	2480	7860c0db8475799a04976b2d4f063e7a.exe	34
PID 2480 wrote to memory of 2740	2480	7860c0db8475799a04976b2d4f063e7a.exe	34
PID 2724 wrote to memory of 2984	2724	7860c0db8475799a04976b2d4f063e7a.exe	35
PID 2724 wrote to memory of 2984	2724	7860c0db8475799a04976b2d4f063e7a.exe	35
PID 2724 wrote to memory of 2984	2724	7860c0db8475799a04976b2d4f063e7a.exe	35
PID 2724 wrote to memory of 2984	2724	7860c0db8475799a04976b2d4f063e7a.exe	35
PID 2724 wrote to memory of 2964	2724	7860c0db8475799a04976b2d4f063e7a.exe	33
PID 2724 wrote to memory of 2964	2724	7860c0db8475799a04976b2d4f063e7a.exe	33
PID 2724 wrote to memory of 2964	2724	7860c0db8475799a04976b2d4f063e7a.exe	33
PID 2724 wrote to memory of 2964	2724	7860c0db8475799a04976b2d4f063e7a.exe	33
PID 2984 wrote to memory of 2748	2984	7860c0db8475799a04976b2d4f063e7a.exe	36
PID 2984 wrote to memory of 2748	2984	7860c0db8475799a04976b2d4f063e7a.exe	36
PID 2984 wrote to memory of 2748	2984	7860c0db8475799a04976b2d4f063e7a.exe	36
PID 2984 wrote to memory of 2748	2984	7860c0db8475799a04976b2d4f063e7a.exe	36
PID 2984 wrote to memory of 2744	2984	7860c0db8475799a04976b2d4f063e7a.exe	37
PID 2984 wrote to memory of 2744	2984	7860c0db8475799a04976b2d4f063e7a.exe	37
PID 2984 wrote to memory of 2744	2984	7860c0db8475799a04976b2d4f063e7a.exe	37
PID 2984 wrote to memory of 2744	2984	7860c0db8475799a04976b2d4f063e7a.exe	37

C:\Users\Admin\AppData\Local\Temp\7860c0db8475799a04976b2d4f063e7a.exe
"C:\Users\Admin\AppData\Local\Temp\7860c0db8475799a04976b2d4f063e7a.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\SysWOW64\7860c0db8475799a04976b2d4f063e7a.exe
  C:\Windows\system32\7860c0db8475799a04976b2d4f063e7a.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2768
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\SysWOW64\7860C0~1.EXE > nul
    3⤵
    PID:2836
- - C:\Windows\SysWOW64\7860c0db8475799a04976b2d4f063e7a.exe
    C:\Windows\system32\7860c0db8475799a04976b2d4f063e7a.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2480
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\SysWOW64\7860C0~1.EXE > nul
      4⤵
      PID:2740
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\7860C0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2848

C:\Windows\SysWOW64\7860c0db8475799a04976b2d4f063e7a.exe
C:\Windows\system32\7860c0db8475799a04976b2d4f063e7a.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Windows\SysWOW64\7860C0~1.EXE > nul
  2⤵
  PID:2964
- C:\Windows\SysWOW64\7860c0db8475799a04976b2d4f063e7a.exe
  C:\Windows\system32\7860c0db8475799a04976b2d4f063e7a.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Windows\SysWOW64\7860c0db8475799a04976b2d4f063e7a.exe
    C:\Windows\system32\7860c0db8475799a04976b2d4f063e7a.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2748
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\SysWOW64\7860C0~1.EXE > nul
    3⤵
    PID:2744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\7860c0db8475799a04976b2d4f063e7a.exe

Filesize
45KB

MD5
7860c0db8475799a04976b2d4f063e7a

SHA1
6d0e54f4c05c1247e9cdb41f284a35c24dd04b6d

SHA256
c0a23e91bce181ee5d97710e386f652839b529a995c73400a891ac36ce0c0743

SHA512
22591f998efa75da7680069bcd241cf6c50e1f009783a6432fa4b73ab19c11b57b7cceb9b0318b026f3da43c347998e8d6c3ec2dab73ab4b40b57522361d37da

Download Submit
memory/2344-0-0x0000000000400000-0x000000000044A1B2-memory.dmp

Filesize
296KB

Download
memory/2344-3-0x0000000000490000-0x00000000004DB000-memory.dmp

Filesize
300KB

Download
memory/2344-10-0x0000000000490000-0x00000000004DB000-memory.dmp

Filesize
300KB

Download
memory/2344-16-0x0000000000400000-0x000000000044A1B2-memory.dmp

Filesize
296KB

Download
memory/2480-17-0x0000000000400000-0x000000000044A1B2-memory.dmp

Filesize
296KB

Download
memory/2480-20-0x0000000000520000-0x000000000056B000-memory.dmp

Filesize
300KB

Download
memory/2480-24-0x0000000000400000-0x000000000044A1B2-memory.dmp

Filesize
296KB

Download
memory/2768-11-0x0000000000400000-0x000000000044A1B2-memory.dmp

Filesize
296KB

Download
memory/2768-21-0x0000000000400000-0x000000000044A1B2-memory.dmp

Filesize
296KB

Download