adfe8f2c6f0df9ea0dbc6640e69344c34fa6d8082f37f9afa54af445b642a8fa

Analysis

max time kernel
1561s
max time network
1565s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 03:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lmao - Copy (6) - Copy.exe
Size 32KB
Sample240228-d4y3aaad37
SHA256 59a15e2c0a04e3dfaa3817f01cc6aba53c58b34b48437bef7005ff3bbb936e56
MD5 7179bf027be44fadde85ec011e11ce7c
SHA1 a676e347f43c0fddc515997ade5b02509bdd1fc0
SHA512 af200694110357de06bbf91aecaabb19617956a5e3ae19925f7f2ce9fa69329874b06a2b07a065f24522b7c25905ddd7d274144c6400127dbf8a2f5d5af7c82b
SSDEEP 384:k0bUe5XB4e0XOOPV4GeyWTctTUFQqz9zObbfG:hT9BuNWDaxb+
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2056	lmao - Copy (6) - Copy.exe
Token: 33	2056	lmao - Copy (6) - Copy.exe
Token: SeIncBasePriorityPrivilege	2056	lmao - Copy (6) - Copy.exe
Token: 33	2056	lmao - Copy (6) - Copy.exe
Token: SeIncBasePriorityPrivilege	2056	lmao - Copy (6) - Copy.exe
Token: 33	2056	lmao - Copy (6) - Copy.exe
Token: SeIncBasePriorityPrivilege	2056	lmao - Copy (6) - Copy.exe
Token: 33	2056	lmao - Copy (6) - Copy.exe
Token: SeIncBasePriorityPrivilege	2056	lmao - Copy (6) - Copy.exe
Token: 33	2056	lmao - Copy (6) - Copy.exe
Token: SeIncBasePriorityPrivilege	2056	lmao - Copy (6) - Copy.exe
Token: 33	2056	lmao - Copy (6) - Copy.exe
Token: SeIncBasePriorityPrivilege	2056	lmao - Copy (6) - Copy.exe
Token: 33	2056	lmao - Copy (6) - Copy.exe
Token: SeIncBasePriorityPrivilege	2056	lmao - Copy (6) - Copy.exe
Token: 33	2056	lmao - Copy (6) - Copy.exe
Token: SeIncBasePriorityPrivilege	2056	lmao - Copy (6) - Copy.exe
Token: 33	2056	lmao - Copy (6) - Copy.exe
Token: SeIncBasePriorityPrivilege	2056	lmao - Copy (6) - Copy.exe
Token: 33	2056	lmao - Copy (6) - Copy.exe
Token: SeIncBasePriorityPrivilege	2056	lmao - Copy (6) - Copy.exe
Token: 33	2056	lmao - Copy (6) - Copy.exe
Token: SeIncBasePriorityPrivilege	2056	lmao - Copy (6) - Copy.exe
Token: 33	2056	lmao - Copy (6) - Copy.exe
Token: SeIncBasePriorityPrivilege	2056	lmao - Copy (6) - Copy.exe
Token: 33	2056	lmao - Copy (6) - Copy.exe
Token: SeIncBasePriorityPrivilege	2056	lmao - Copy (6) - Copy.exe
Token: 33	2056	lmao - Copy (6) - Copy.exe
Token: SeIncBasePriorityPrivilege	2056	lmao - Copy (6) - Copy.exe
Token: 33	2056	lmao - Copy (6) - Copy.exe
Token: SeIncBasePriorityPrivilege	2056	lmao - Copy (6) - Copy.exe
Token: 33	2056	lmao - Copy (6) - Copy.exe
Token: SeIncBasePriorityPrivilege	2056	lmao - Copy (6) - Copy.exe
Token: 33	2056	lmao - Copy (6) - Copy.exe
Token: SeIncBasePriorityPrivilege	2056	lmao - Copy (6) - Copy.exe
Token: 33	2056	lmao - Copy (6) - Copy.exe
Token: SeIncBasePriorityPrivilege	2056	lmao - Copy (6) - Copy.exe
Token: 33	2056	lmao - Copy (6) - Copy.exe
Token: SeIncBasePriorityPrivilege	2056	lmao - Copy (6) - Copy.exe
Token: 33	2056	lmao - Copy (6) - Copy.exe
Token: SeIncBasePriorityPrivilege	2056	lmao - Copy (6) - Copy.exe
Token: 33	2056	lmao - Copy (6) - Copy.exe
Token: SeIncBasePriorityPrivilege	2056	lmao - Copy (6) - Copy.exe
Token: 33	2056	lmao - Copy (6) - Copy.exe
Token: SeIncBasePriorityPrivilege	2056	lmao - Copy (6) - Copy.exe
Token: 33	2056	lmao - Copy (6) - Copy.exe
Token: SeIncBasePriorityPrivilege	2056	lmao - Copy (6) - Copy.exe
Token: 33	2056	lmao - Copy (6) - Copy.exe
Token: SeIncBasePriorityPrivilege	2056	lmao - Copy (6) - Copy.exe
Token: 33	2056	lmao - Copy (6) - Copy.exe
Token: SeIncBasePriorityPrivilege	2056	lmao - Copy (6) - Copy.exe
Token: 33	2056	lmao - Copy (6) - Copy.exe
Token: SeIncBasePriorityPrivilege	2056	lmao - Copy (6) - Copy.exe
Token: 33	2056	lmao - Copy (6) - Copy.exe
Token: SeIncBasePriorityPrivilege	2056	lmao - Copy (6) - Copy.exe
Token: 33	2056	lmao - Copy (6) - Copy.exe
Token: SeIncBasePriorityPrivilege	2056	lmao - Copy (6) - Copy.exe
Token: 33	2056	lmao - Copy (6) - Copy.exe
Token: SeIncBasePriorityPrivilege	2056	lmao - Copy (6) - Copy.exe
Token: 33	2056	lmao - Copy (6) - Copy.exe
Token: SeIncBasePriorityPrivilege	2056	lmao - Copy (6) - Copy.exe
Token: 33	2056	lmao - Copy (6) - Copy.exe
Token: SeIncBasePriorityPrivilege	2056	lmao - Copy (6) - Copy.exe
Token: 33	2056	lmao - Copy (6) - Copy.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 1020	2056	lmao - Copy (6) - Copy.exe	31
PID 2056 wrote to memory of 1020	2056	lmao - Copy (6) - Copy.exe	31
PID 2056 wrote to memory of 1020	2056	lmao - Copy (6) - Copy.exe	31
PID 2056 wrote to memory of 1020	2056	lmao - Copy (6) - Copy.exe	31

C:\Users\Admin\AppData\Local\Temp\lmao - Copy (6) - Copy.exe
"C:\Users\Admin\AppData\Local\Temp\lmao - Copy (6) - Copy.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C Y /N /D Y /T 1 & Del "C:\Users\Admin\AppData\Local\Temp\lmao - Copy (6) - Copy.exe"
  2⤵
  PID:1020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2056-0-0x0000000074390000-0x000000007493B000-memory.dmp

Download

memory/2056-1-0x0000000000810000-0x0000000000850000-memory.dmp

Download

memory/2056-2-0x0000000074390000-0x000000007493B000-memory.dmp

Download

memory/2056-3-0x0000000074390000-0x000000007493B000-memory.dmp

Download

memory/2056-4-0x0000000074390000-0x000000007493B000-memory.dmp

Download

memory/2056-5-0x0000000000810000-0x0000000000850000-memory.dmp

Download

memory/2056-6-0x0000000074390000-0x000000007493B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads