7ddfd71561a28ec11b17f6c1934478ce6d8839ffdc54832fd7f8d77247f4dc68

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25-02-2024 05:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a2f770eea28411f68b627abb2ec22cd9.exe
Size

323KB
MD5

a2f770eea28411f68b627abb2ec22cd9
SHA1

fe12491467fee18afe2b4a2604b5eec6c91ce137
SHA256

7ddfd71561a28ec11b17f6c1934478ce6d8839ffdc54832fd7f8d77247f4dc68
SHA512

b52db7594717972a2aa94f86c49db1086df86bc92b69250ba3eff7a593da524252196cdbd3f4167041a7e6e2802c47493aa674e5cbbf5fd9f9395256a4db3a6d
SSDEEP

6144:cdF2idZecnl20lHRxp3gz+jAhSz69i063x8w5eWJAlCn:wF3Z4mxx4+jAh/078w5jAlCn

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2228	a2f770eea28411f68b627abb2ec22cd9.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\a2f770eea28411f68b627abb2ec22cd9.exe	a2f770eea28411f68b627abb2ec22cd9.exe
File opened for modification	C:\Windows\SysWOW64\a2f770eea28411f68b627abb2ec22cd9.exe	a2f770eea28411f68b627abb2ec22cd9.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4824	a2f770eea28411f68b627abb2ec22cd9.exe
4824	a2f770eea28411f68b627abb2ec22cd9.exe
4824	a2f770eea28411f68b627abb2ec22cd9.exe
4824	a2f770eea28411f68b627abb2ec22cd9.exe
4824	a2f770eea28411f68b627abb2ec22cd9.exe
4824	a2f770eea28411f68b627abb2ec22cd9.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4824	a2f770eea28411f68b627abb2ec22cd9.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 1408	4824	a2f770eea28411f68b627abb2ec22cd9.exe	88
PID 4824 wrote to memory of 1408	4824	a2f770eea28411f68b627abb2ec22cd9.exe	88
PID 4824 wrote to memory of 1408	4824	a2f770eea28411f68b627abb2ec22cd9.exe	88

C:\Users\Admin\AppData\Local\Temp\a2f770eea28411f68b627abb2ec22cd9.exe
"C:\Users\Admin\AppData\Local\Temp\a2f770eea28411f68b627abb2ec22cd9.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\A2F770~1.EXE > nul
  2⤵
  PID:1408

C:\Windows\SysWOW64\a2f770eea28411f68b627abb2ec22cd9.exe
C:\Windows\SysWOW64\a2f770eea28411f68b627abb2ec22cd9.exe
1⤵
- Executes dropped EXE
PID:2228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\a2f770eea28411f68b627abb2ec22cd9.exe

Filesize
323KB

MD5
a2f770eea28411f68b627abb2ec22cd9

SHA1
fe12491467fee18afe2b4a2604b5eec6c91ce137

SHA256
7ddfd71561a28ec11b17f6c1934478ce6d8839ffdc54832fd7f8d77247f4dc68

SHA512
b52db7594717972a2aa94f86c49db1086df86bc92b69250ba3eff7a593da524252196cdbd3f4167041a7e6e2802c47493aa674e5cbbf5fd9f9395256a4db3a6d

Download Submit
memory/2228-61-0x0000000000F80000-0x0000000000F81000-memory.dmp

Filesize
4KB

Download
memory/2228-66-0x0000000001E40000-0x0000000001E41000-memory.dmp

Filesize
4KB

Download
memory/2228-60-0x0000000001E40000-0x0000000001E41000-memory.dmp

Filesize
4KB

Download
memory/2228-58-0x0000000001E50000-0x0000000001E51000-memory.dmp

Filesize
4KB

Download
memory/2228-64-0x0000000001E50000-0x0000000001E51000-memory.dmp

Filesize
4KB

Download
memory/2228-63-0x0000000001E50000-0x0000000001E51000-memory.dmp

Filesize
4KB

Download
memory/2228-62-0x0000000001E50000-0x0000000001E51000-memory.dmp

Filesize
4KB

Download
memory/2228-51-0x0000000000850000-0x00000000008A4000-memory.dmp

Filesize
336KB

Download
memory/2228-52-0x0000000001E50000-0x0000000001E51000-memory.dmp

Filesize
4KB

Download
memory/2228-67-0x0000000001E40000-0x0000000001E41000-memory.dmp

Filesize
4KB

Download
memory/2228-65-0x0000000001E40000-0x0000000001E41000-memory.dmp

Filesize
4KB

Download
memory/2228-57-0x0000000001E50000-0x0000000001E51000-memory.dmp

Filesize
4KB

Download
memory/2228-56-0x0000000001E50000-0x0000000001E51000-memory.dmp

Filesize
4KB

Download
memory/2228-55-0x0000000001E50000-0x0000000001E51000-memory.dmp

Filesize
4KB

Download
memory/2228-54-0x0000000001E50000-0x0000000001E51000-memory.dmp

Filesize
4KB

Download
memory/2228-96-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/2228-53-0x0000000001E50000-0x0000000001E51000-memory.dmp

Filesize
4KB

Download
memory/2228-59-0x0000000001E50000-0x0000000001E51000-memory.dmp

Filesize
4KB

Download
memory/4824-15-0x0000000003310000-0x0000000003390000-memory.dmp

Filesize
512KB

Download
memory/4824-34-0x00000000023C0000-0x00000000023C1000-memory.dmp

Filesize
4KB

Download
memory/4824-23-0x0000000003310000-0x0000000003390000-memory.dmp

Filesize
512KB

Download
memory/4824-22-0x0000000003310000-0x0000000003390000-memory.dmp

Filesize
512KB

Download
memory/4824-21-0x0000000003310000-0x0000000003390000-memory.dmp

Filesize
512KB

Download
memory/4824-26-0x0000000003310000-0x0000000003390000-memory.dmp

Filesize
512KB

Download
memory/4824-27-0x0000000002380000-0x0000000002381000-memory.dmp

Filesize
4KB

Download
memory/4824-28-0x0000000002360000-0x0000000002361000-memory.dmp

Filesize
4KB

Download
memory/4824-30-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/4824-31-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/4824-44-0x0000000003310000-0x0000000003390000-memory.dmp

Filesize
512KB

Download
memory/4824-43-0x0000000003310000-0x0000000003390000-memory.dmp

Filesize
512KB

Download
memory/4824-45-0x0000000003310000-0x0000000003390000-memory.dmp

Filesize
512KB

Download
memory/4824-42-0x0000000003310000-0x0000000003390000-memory.dmp

Filesize
512KB

Download
memory/4824-46-0x0000000003310000-0x0000000003390000-memory.dmp

Filesize
512KB

Download
memory/4824-41-0x0000000003310000-0x0000000003390000-memory.dmp

Filesize
512KB

Download
memory/4824-40-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/4824-39-0x00000000023E0000-0x00000000023E1000-memory.dmp

Filesize
4KB

Download
memory/4824-38-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/4824-47-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/4824-37-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download
memory/4824-36-0x0000000002430000-0x0000000002431000-memory.dmp

Filesize
4KB

Download
memory/4824-35-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download
memory/4824-24-0x0000000003310000-0x0000000003390000-memory.dmp

Filesize
512KB

Download
memory/4824-33-0x0000000002390000-0x0000000002391000-memory.dmp

Filesize
4KB

Download
memory/4824-32-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/4824-29-0x00000000023B0000-0x00000000023B1000-memory.dmp

Filesize
4KB

Download
memory/4824-49-0x0000000000660000-0x00000000006B4000-memory.dmp

Filesize
336KB

Download
memory/4824-25-0x0000000003310000-0x0000000003390000-memory.dmp

Filesize
512KB

Download
memory/4824-50-0x0000000003310000-0x0000000003390000-memory.dmp

Filesize
512KB

Download
memory/4824-20-0x0000000003310000-0x0000000003390000-memory.dmp

Filesize
512KB

Download
memory/4824-48-0x0000000003310000-0x0000000003390000-memory.dmp

Filesize
512KB

Download
memory/4824-19-0x0000000003310000-0x0000000003390000-memory.dmp

Filesize
512KB

Download
memory/4824-0-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/4824-14-0x0000000002310000-0x0000000002311000-memory.dmp

Filesize
4KB

Download
memory/4824-3-0x00000000021A0000-0x00000000021A1000-memory.dmp

Filesize
4KB

Download
memory/4824-4-0x0000000002300000-0x0000000002301000-memory.dmp

Filesize
4KB

Download
memory/4824-5-0x0000000002180000-0x0000000002181000-memory.dmp

Filesize
4KB

Download
memory/4824-6-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/4824-12-0x0000000003310000-0x0000000003390000-memory.dmp

Filesize
512KB

Download
memory/4824-13-0x0000000003310000-0x0000000003390000-memory.dmp

Filesize
512KB

Download
memory/4824-10-0x0000000003310000-0x0000000003390000-memory.dmp

Filesize
512KB

Download
memory/4824-11-0x0000000003310000-0x0000000003390000-memory.dmp

Filesize
512KB

Download
memory/4824-7-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/4824-9-0x0000000003310000-0x0000000003390000-memory.dmp

Filesize
512KB

Download
memory/4824-8-0x00000000021D0000-0x00000000021D1000-memory.dmp

Filesize
4KB

Download
memory/4824-2-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/4824-1-0x0000000000660000-0x00000000006B4000-memory.dmp

Filesize
336KB

Download