6d0bdc06e00b3815a8a7c1574f75ed5ff25d9af65772a980f28bc0c28345a7ab

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-03-2024 02:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b8443fce2e8923a0fc1d7807dcd38935.exe
Size

117KB
MD5

b8443fce2e8923a0fc1d7807dcd38935
SHA1

77d869c9681b6d17b415b83de7b202977b15042f
SHA256

6d0bdc06e00b3815a8a7c1574f75ed5ff25d9af65772a980f28bc0c28345a7ab
SHA512

7ff78400a30c4f31edc363715cc649eacaac204dbb725f225bd6069971e5489e2b985918f99b7ce6ec26c83e4e6612a3ac96cf0fc8782874c0ea72c38b0c8ffd
SSDEEP

3072:viZQ8NuB86J8rkAaQFImXbI2KAGkKihMNDQll/:qe8NuB3clbeAGbihgG9

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2300	b8443fce2e8923a0fc1d7807dcd38935.exe

Suspicious behavior: MapViewOfSection 21 IoCs

pid	Process
2300	b8443fce2e8923a0fc1d7807dcd38935.exe
2300	b8443fce2e8923a0fc1d7807dcd38935.exe
2300	b8443fce2e8923a0fc1d7807dcd38935.exe
2300	b8443fce2e8923a0fc1d7807dcd38935.exe
2300	b8443fce2e8923a0fc1d7807dcd38935.exe
2300	b8443fce2e8923a0fc1d7807dcd38935.exe
2300	b8443fce2e8923a0fc1d7807dcd38935.exe
2300	b8443fce2e8923a0fc1d7807dcd38935.exe
2300	b8443fce2e8923a0fc1d7807dcd38935.exe
2300	b8443fce2e8923a0fc1d7807dcd38935.exe
2300	b8443fce2e8923a0fc1d7807dcd38935.exe
2300	b8443fce2e8923a0fc1d7807dcd38935.exe
2300	b8443fce2e8923a0fc1d7807dcd38935.exe
2300	b8443fce2e8923a0fc1d7807dcd38935.exe
2300	b8443fce2e8923a0fc1d7807dcd38935.exe
2300	b8443fce2e8923a0fc1d7807dcd38935.exe
2300	b8443fce2e8923a0fc1d7807dcd38935.exe
2300	b8443fce2e8923a0fc1d7807dcd38935.exe
2300	b8443fce2e8923a0fc1d7807dcd38935.exe
2300	b8443fce2e8923a0fc1d7807dcd38935.exe
2300	b8443fce2e8923a0fc1d7807dcd38935.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2300	b8443fce2e8923a0fc1d7807dcd38935.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 372	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	3
PID 2300 wrote to memory of 372	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	3
PID 2300 wrote to memory of 372	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	3
PID 2300 wrote to memory of 372	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	3
PID 2300 wrote to memory of 372	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	3
PID 2300 wrote to memory of 372	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	3
PID 2300 wrote to memory of 372	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	3
PID 2300 wrote to memory of 384	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	4
PID 2300 wrote to memory of 384	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	4
PID 2300 wrote to memory of 384	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	4
PID 2300 wrote to memory of 384	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	4
PID 2300 wrote to memory of 384	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	4
PID 2300 wrote to memory of 384	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	4
PID 2300 wrote to memory of 384	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	4
PID 2300 wrote to memory of 420	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	5
PID 2300 wrote to memory of 420	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	5
PID 2300 wrote to memory of 420	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	5
PID 2300 wrote to memory of 420	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	5
PID 2300 wrote to memory of 420	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	5
PID 2300 wrote to memory of 420	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	5
PID 2300 wrote to memory of 420	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	5
PID 2300 wrote to memory of 464	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	6
PID 2300 wrote to memory of 464	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	6
PID 2300 wrote to memory of 464	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	6
PID 2300 wrote to memory of 464	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	6
PID 2300 wrote to memory of 464	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	6
PID 2300 wrote to memory of 464	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	6
PID 2300 wrote to memory of 464	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	6
PID 2300 wrote to memory of 480	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	7
PID 2300 wrote to memory of 480	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	7
PID 2300 wrote to memory of 480	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	7
PID 2300 wrote to memory of 480	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	7
PID 2300 wrote to memory of 480	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	7
PID 2300 wrote to memory of 480	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	7
PID 2300 wrote to memory of 480	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	7
PID 2300 wrote to memory of 488	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	8
PID 2300 wrote to memory of 488	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	8
PID 2300 wrote to memory of 488	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	8
PID 2300 wrote to memory of 488	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	8
PID 2300 wrote to memory of 488	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	8
PID 2300 wrote to memory of 488	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	8
PID 2300 wrote to memory of 488	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	8
PID 2300 wrote to memory of 588	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	9
PID 2300 wrote to memory of 588	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	9
PID 2300 wrote to memory of 588	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	9
PID 2300 wrote to memory of 588	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	9
PID 2300 wrote to memory of 588	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	9
PID 2300 wrote to memory of 588	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	9
PID 2300 wrote to memory of 588	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	9
PID 2300 wrote to memory of 672	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	10
PID 2300 wrote to memory of 672	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	10
PID 2300 wrote to memory of 672	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	10
PID 2300 wrote to memory of 672	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	10
PID 2300 wrote to memory of 672	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	10
PID 2300 wrote to memory of 672	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	10
PID 2300 wrote to memory of 672	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	10
PID 2300 wrote to memory of 756	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	11
PID 2300 wrote to memory of 756	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	11
PID 2300 wrote to memory of 756	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	11
PID 2300 wrote to memory of 756	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	11
PID 2300 wrote to memory of 756	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	11
PID 2300 wrote to memory of 756	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	11
PID 2300 wrote to memory of 756	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	11
PID 2300 wrote to memory of 808	2300	b8443fce2e8923a0fc1d7807dcd38935.exe	12

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:372
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:464
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:588
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:2400
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:672
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:756
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:808
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1176
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:848
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:988
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:296
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:608
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1072
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1112
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:3056
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:2108
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:480
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:488

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:384

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1216
- C:\Users\Admin\AppData\Local\Temp\b8443fce2e8923a0fc1d7807dcd38935.exe
  "C:\Users\Admin\AppData\Local\Temp\b8443fce2e8923a0fc1d7807dcd38935.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2300

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2300-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2300-3-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2300-2-0x000000007719F000-0x00000000771A0000-memory.dmp

Filesize
4KB

Download
memory/2300-1-0x00000000771A0000-0x00000000771A1000-memory.dmp

Filesize
4KB

Download