48dfb8260c93ed4795b6ee2e91333e83cd492b15fea19df5af466b0d4f755a96

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 07:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a1445abc6df1ef5983dcb2b6a4810ca3.exe
Size

193KB
MD5

a1445abc6df1ef5983dcb2b6a4810ca3
SHA1

238c4bd94c310d1845b40b296afb00c44ed91d84
SHA256

48dfb8260c93ed4795b6ee2e91333e83cd492b15fea19df5af466b0d4f755a96
SHA512

ad4e0334f1dd4bc19ce52a7f5ec59afb497c1fb595b27aae940ab2aaf42b640d544f02ed0f758e73179d29d480930d783a736e2e2fb1442883fe41beb151d4a5
SSDEEP

3072:NTUtZpaaUJ7FlxTTUXdu/6NIqjRcNQl7BQERFmTdYiKD6VtJGRzLjMCJd2:RcpavHIfNXbgE7mqiKD6Vt0zPMCJd

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2296-0-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/memory/2296-5-0x0000000000400000-0x000000000044F000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe

Suspicious behavior: MapViewOfSection 21 IoCs

pid	Process
2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe
2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe
2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe
2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe
2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe
2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe
2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe
2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe
2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe
2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe
2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe
2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe
2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe
2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe
2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe
2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe
2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe
2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe
2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe
2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe
2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 372	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	5
PID 2296 wrote to memory of 372	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	5
PID 2296 wrote to memory of 372	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	5
PID 2296 wrote to memory of 372	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	5
PID 2296 wrote to memory of 372	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	5
PID 2296 wrote to memory of 372	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	5
PID 2296 wrote to memory of 372	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	5
PID 2296 wrote to memory of 380	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	4
PID 2296 wrote to memory of 380	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	4
PID 2296 wrote to memory of 380	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	4
PID 2296 wrote to memory of 380	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	4
PID 2296 wrote to memory of 380	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	4
PID 2296 wrote to memory of 380	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	4
PID 2296 wrote to memory of 380	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	4
PID 2296 wrote to memory of 420	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	3
PID 2296 wrote to memory of 420	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	3
PID 2296 wrote to memory of 420	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	3
PID 2296 wrote to memory of 420	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	3
PID 2296 wrote to memory of 420	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	3
PID 2296 wrote to memory of 420	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	3
PID 2296 wrote to memory of 420	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	3
PID 2296 wrote to memory of 464	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	2
PID 2296 wrote to memory of 464	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	2
PID 2296 wrote to memory of 464	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	2
PID 2296 wrote to memory of 464	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	2
PID 2296 wrote to memory of 464	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	2
PID 2296 wrote to memory of 464	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	2
PID 2296 wrote to memory of 464	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	2
PID 2296 wrote to memory of 480	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	1
PID 2296 wrote to memory of 480	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	1
PID 2296 wrote to memory of 480	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	1
PID 2296 wrote to memory of 480	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	1
PID 2296 wrote to memory of 480	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	1
PID 2296 wrote to memory of 480	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	1
PID 2296 wrote to memory of 480	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	1
PID 2296 wrote to memory of 488	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	8
PID 2296 wrote to memory of 488	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	8
PID 2296 wrote to memory of 488	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	8
PID 2296 wrote to memory of 488	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	8
PID 2296 wrote to memory of 488	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	8
PID 2296 wrote to memory of 488	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	8
PID 2296 wrote to memory of 488	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	8
PID 2296 wrote to memory of 600	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	22
PID 2296 wrote to memory of 600	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	22
PID 2296 wrote to memory of 600	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	22
PID 2296 wrote to memory of 600	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	22
PID 2296 wrote to memory of 600	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	22
PID 2296 wrote to memory of 600	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	22
PID 2296 wrote to memory of 600	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	22
PID 2296 wrote to memory of 680	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	21
PID 2296 wrote to memory of 680	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	21
PID 2296 wrote to memory of 680	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	21
PID 2296 wrote to memory of 680	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	21
PID 2296 wrote to memory of 680	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	21
PID 2296 wrote to memory of 680	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	21
PID 2296 wrote to memory of 680	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	21
PID 2296 wrote to memory of 744	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	20
PID 2296 wrote to memory of 744	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	20
PID 2296 wrote to memory of 744	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	20
PID 2296 wrote to memory of 744	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	20
PID 2296 wrote to memory of 744	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	20
PID 2296 wrote to memory of 744	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	20
PID 2296 wrote to memory of 744	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	20
PID 2296 wrote to memory of 820	2296	a1445abc6df1ef5983dcb2b6a4810ca3.exe	18

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:480

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:464
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:856
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:288
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1036
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1144
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:272
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:980
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:820
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:744
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:680
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:600
- - C:\Windows\system32\DllHost.exe
    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
    3⤵
    PID:296
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:2928
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:3040

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:380

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:372
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:488

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1236

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1284
- C:\Users\Admin\AppData\Local\Temp\a1445abc6df1ef5983dcb2b6a4810ca3.exe
  "C:\Users\Admin\AppData\Local\Temp\a1445abc6df1ef5983dcb2b6a4810ca3.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2296

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2296-0-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2296-1-0x000000007774F000-0x0000000077750000-memory.dmp

Filesize
4KB

Download
memory/2296-3-0x0000000077750000-0x0000000077751000-memory.dmp

Filesize
4KB

Download
memory/2296-5-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download