33b7ab781db25b68797335f9248fad623fdc24267b71749ab2bfca02dd6a29aa

Analysis

max time kernel
147s
max time network
151s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/01/2024, 21:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e1cba21f7a7b01fbcef46990c41884d.exe
Size

60KB
MD5

7e1cba21f7a7b01fbcef46990c41884d
SHA1

a384951086aa20d842b85f3225b27775333e01d5
SHA256

33b7ab781db25b68797335f9248fad623fdc24267b71749ab2bfca02dd6a29aa
SHA512

8caf1b89425bb0a5f8462d0e892a760b24e2ce7bf59cdfa08798faabbd0201aea96352715acf8fba6bbfb02c0b9bbb383c64c3a6f60a7c2cda593aca67291f8a
SSDEEP

1536:HN8yaTT80wUq63kXSWLu5Oo9RIpzWk1oPz:uya/VkXSWUXoWk1oP

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2056	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2088	sript.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sript.exe	7e1cba21f7a7b01fbcef46990c41884d.exe
File opened for modification	C:\Windows\SysWOW64\sript.exe	7e1cba21f7a7b01fbcef46990c41884d.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
2844	taskkill.exe
2908	taskkill.exe
1960	taskkill.exe
2700	taskkill.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2252	7e1cba21f7a7b01fbcef46990c41884d.exe
2252	7e1cba21f7a7b01fbcef46990c41884d.exe
2088	sript.exe
2088	sript.exe
2088	sript.exe
2088	sript.exe
2088	sript.exe
2088	sript.exe
2088	sript.exe
2088	sript.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2252	7e1cba21f7a7b01fbcef46990c41884d.exe
Token: SeDebugPrivilege	1960	taskkill.exe
Token: SeDebugPrivilege	2844	taskkill.exe
Token: SeDebugPrivilege	2700	taskkill.exe
Token: SeDebugPrivilege	2908	taskkill.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2508	2252	7e1cba21f7a7b01fbcef46990c41884d.exe	28
PID 2252 wrote to memory of 2508	2252	7e1cba21f7a7b01fbcef46990c41884d.exe	28
PID 2252 wrote to memory of 2508	2252	7e1cba21f7a7b01fbcef46990c41884d.exe	28
PID 2252 wrote to memory of 2508	2252	7e1cba21f7a7b01fbcef46990c41884d.exe	28
PID 2252 wrote to memory of 1744	2252	7e1cba21f7a7b01fbcef46990c41884d.exe	29
PID 2252 wrote to memory of 1744	2252	7e1cba21f7a7b01fbcef46990c41884d.exe	29
PID 2252 wrote to memory of 1744	2252	7e1cba21f7a7b01fbcef46990c41884d.exe	29
PID 2252 wrote to memory of 1744	2252	7e1cba21f7a7b01fbcef46990c41884d.exe	29
PID 2088 wrote to memory of 2168	2088	sript.exe	33
PID 2088 wrote to memory of 2168	2088	sript.exe	33
PID 2088 wrote to memory of 2168	2088	sript.exe	33
PID 2088 wrote to memory of 2168	2088	sript.exe	33
PID 2088 wrote to memory of 1796	2088	sript.exe	35
PID 2088 wrote to memory of 1796	2088	sript.exe	35
PID 2088 wrote to memory of 1796	2088	sript.exe	35
PID 2088 wrote to memory of 1796	2088	sript.exe	35
PID 2508 wrote to memory of 2844	2508	cmd.exe	36
PID 2508 wrote to memory of 2844	2508	cmd.exe	36
PID 2508 wrote to memory of 2844	2508	cmd.exe	36
PID 2508 wrote to memory of 2844	2508	cmd.exe	36
PID 1744 wrote to memory of 2908	1744	cmd.exe	37
PID 1744 wrote to memory of 2908	1744	cmd.exe	37
PID 1744 wrote to memory of 2908	1744	cmd.exe	37
PID 1744 wrote to memory of 2908	1744	cmd.exe	37
PID 2252 wrote to memory of 2056	2252	7e1cba21f7a7b01fbcef46990c41884d.exe	39
PID 2252 wrote to memory of 2056	2252	7e1cba21f7a7b01fbcef46990c41884d.exe	39
PID 2252 wrote to memory of 2056	2252	7e1cba21f7a7b01fbcef46990c41884d.exe	39
PID 2252 wrote to memory of 2056	2252	7e1cba21f7a7b01fbcef46990c41884d.exe	39
PID 2168 wrote to memory of 1960	2168	cmd.exe	40
PID 2168 wrote to memory of 1960	2168	cmd.exe	40
PID 2168 wrote to memory of 1960	2168	cmd.exe	40
PID 2168 wrote to memory of 1960	2168	cmd.exe	40
PID 1796 wrote to memory of 2700	1796	cmd.exe	41
PID 1796 wrote to memory of 2700	1796	cmd.exe	41
PID 1796 wrote to memory of 2700	1796	cmd.exe	41
PID 1796 wrote to memory of 2700	1796	cmd.exe	41

C:\Users\Admin\AppData\Local\Temp\7e1cba21f7a7b01fbcef46990c41884d.exe
"C:\Users\Admin\AppData\Local\Temp\7e1cba21f7a7b01fbcef46990c41884d.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im rfwstub.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im rfwstub.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2844
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im rfwproxy.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im rfwproxy.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\7E1CBA~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2056

C:\Windows\SysWOW64\sript.exe
C:\Windows\SysWOW64\sript.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im rfwstub.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im rfwstub.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1960
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im rfwproxy.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1796
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im rfwproxy.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\sript.exe

Filesize
60KB

MD5
7e1cba21f7a7b01fbcef46990c41884d

SHA1
a384951086aa20d842b85f3225b27775333e01d5

SHA256
33b7ab781db25b68797335f9248fad623fdc24267b71749ab2bfca02dd6a29aa

SHA512
8caf1b89425bb0a5f8462d0e892a760b24e2ce7bf59cdfa08798faabbd0201aea96352715acf8fba6bbfb02c0b9bbb383c64c3a6f60a7c2cda593aca67291f8a

Download Submit