872b5356c8b72e6b50713302d494305763367ac7a9646e2f5a5a92c70fed2810 | Triage

Analysis

max time kernel
149s
max time network
148s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/01/2024, 00:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7e59d8ca91f673a3844e51eabc374639.exe
Size

15KB
MD5

7e59d8ca91f673a3844e51eabc374639
SHA1

5be9008ca6e85a35d0df2d19382d77215f822ff2
SHA256

872b5356c8b72e6b50713302d494305763367ac7a9646e2f5a5a92c70fed2810
SHA512

55bb35a66075071f3aafe2145fa6b4367debc502a779c5749f1a5a0ced6bfe8c257d6b96169e3bbf236b85adc23b3c605941378059c17d87a19c8a70b42d4397
SSDEEP

384:Ey0OqZi71JQw+yn14AWah+LH+PqyzWnQKU:EyRsi71SwFWaILefzWQr

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1912	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1092	7e59d8ca91f673a3844e51eabc374639.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\7e59d8ca91f673a3844e51eabc374639.exe	7e59d8ca91f673a3844e51eabc374639.exe
File opened for modification	C:\Windows\SysWOW64\7e59d8ca91f673a3844e51eabc374639.exe	7e59d8ca91f673a3844e51eabc374639.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2128	7e59d8ca91f673a3844e51eabc374639.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 1912	2128	7e59d8ca91f673a3844e51eabc374639.exe	29
PID 2128 wrote to memory of 1912	2128	7e59d8ca91f673a3844e51eabc374639.exe	29
PID 2128 wrote to memory of 1912	2128	7e59d8ca91f673a3844e51eabc374639.exe	29
PID 2128 wrote to memory of 1912	2128	7e59d8ca91f673a3844e51eabc374639.exe	29

C:\Users\Admin\AppData\Local\Temp\7e59d8ca91f673a3844e51eabc374639.exe
"C:\Users\Admin\AppData\Local\Temp\7e59d8ca91f673a3844e51eabc374639.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\7E59D8~1.EXE > nul
  2⤵
  - Deletes itself
  PID:1912

C:\Windows\SysWOW64\7e59d8ca91f673a3844e51eabc374639.exe
C:\Windows\SysWOW64\7e59d8ca91f673a3844e51eabc374639.exe
1⤵
- Executes dropped EXE
PID:1092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\7e59d8ca91f673a3844e51eabc374639.exe

Filesize
15KB

MD5
7e59d8ca91f673a3844e51eabc374639

SHA1
5be9008ca6e85a35d0df2d19382d77215f822ff2

SHA256
872b5356c8b72e6b50713302d494305763367ac7a9646e2f5a5a92c70fed2810

SHA512
55bb35a66075071f3aafe2145fa6b4367debc502a779c5749f1a5a0ced6bfe8c257d6b96169e3bbf236b85adc23b3c605941378059c17d87a19c8a70b42d4397

Download Submit