21dd39890574d4c9528cd21df116ae1175908af961bfeedd300e8e32a588dedb

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-03-2024 16:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cbf0816c1d4f0f42594c7443df3503f3.exe
Size

83KB
MD5

cbf0816c1d4f0f42594c7443df3503f3
SHA1

abd56976b0fc235689c24ce0286e4603536a5a9d
SHA256

21dd39890574d4c9528cd21df116ae1175908af961bfeedd300e8e32a588dedb
SHA512

eb9bb9740905af3f712a809c3c401d9a12a0ca054c022c7f4a27fbb680725f76dbbcb867fac1fded63b53b30be8b3c30998f97267395b770cd713b12e2b4f779
SSDEEP

1536:a0PYFtRtCbQK0rpH6VygrUGGgojHMFVkyC1CuYIPw:aRFaVEGfrUGXojHMcLV

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2212	cbf0816c1d4f0f42594c7443df3503f3.exe

Suspicious behavior: MapViewOfSection 22 IoCs

pid	Process
2212	cbf0816c1d4f0f42594c7443df3503f3.exe
2212	cbf0816c1d4f0f42594c7443df3503f3.exe
2212	cbf0816c1d4f0f42594c7443df3503f3.exe
2212	cbf0816c1d4f0f42594c7443df3503f3.exe
2212	cbf0816c1d4f0f42594c7443df3503f3.exe
2212	cbf0816c1d4f0f42594c7443df3503f3.exe
2212	cbf0816c1d4f0f42594c7443df3503f3.exe
2212	cbf0816c1d4f0f42594c7443df3503f3.exe
2212	cbf0816c1d4f0f42594c7443df3503f3.exe
2212	cbf0816c1d4f0f42594c7443df3503f3.exe
2212	cbf0816c1d4f0f42594c7443df3503f3.exe
2212	cbf0816c1d4f0f42594c7443df3503f3.exe
2212	cbf0816c1d4f0f42594c7443df3503f3.exe
2212	cbf0816c1d4f0f42594c7443df3503f3.exe
2212	cbf0816c1d4f0f42594c7443df3503f3.exe
2212	cbf0816c1d4f0f42594c7443df3503f3.exe
2212	cbf0816c1d4f0f42594c7443df3503f3.exe
2212	cbf0816c1d4f0f42594c7443df3503f3.exe
2212	cbf0816c1d4f0f42594c7443df3503f3.exe
2212	cbf0816c1d4f0f42594c7443df3503f3.exe
2212	cbf0816c1d4f0f42594c7443df3503f3.exe
2212	cbf0816c1d4f0f42594c7443df3503f3.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2212	cbf0816c1d4f0f42594c7443df3503f3.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 372	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	3
PID 2212 wrote to memory of 372	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	3
PID 2212 wrote to memory of 372	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	3
PID 2212 wrote to memory of 372	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	3
PID 2212 wrote to memory of 372	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	3
PID 2212 wrote to memory of 372	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	3
PID 2212 wrote to memory of 372	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	3
PID 2212 wrote to memory of 380	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	4
PID 2212 wrote to memory of 380	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	4
PID 2212 wrote to memory of 380	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	4
PID 2212 wrote to memory of 380	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	4
PID 2212 wrote to memory of 380	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	4
PID 2212 wrote to memory of 380	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	4
PID 2212 wrote to memory of 380	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	4
PID 2212 wrote to memory of 420	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	5
PID 2212 wrote to memory of 420	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	5
PID 2212 wrote to memory of 420	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	5
PID 2212 wrote to memory of 420	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	5
PID 2212 wrote to memory of 420	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	5
PID 2212 wrote to memory of 420	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	5
PID 2212 wrote to memory of 420	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	5
PID 2212 wrote to memory of 464	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	6
PID 2212 wrote to memory of 464	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	6
PID 2212 wrote to memory of 464	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	6
PID 2212 wrote to memory of 464	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	6
PID 2212 wrote to memory of 464	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	6
PID 2212 wrote to memory of 464	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	6
PID 2212 wrote to memory of 464	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	6
PID 2212 wrote to memory of 480	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	7
PID 2212 wrote to memory of 480	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	7
PID 2212 wrote to memory of 480	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	7
PID 2212 wrote to memory of 480	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	7
PID 2212 wrote to memory of 480	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	7
PID 2212 wrote to memory of 480	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	7
PID 2212 wrote to memory of 480	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	7
PID 2212 wrote to memory of 488	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	8
PID 2212 wrote to memory of 488	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	8
PID 2212 wrote to memory of 488	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	8
PID 2212 wrote to memory of 488	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	8
PID 2212 wrote to memory of 488	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	8
PID 2212 wrote to memory of 488	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	8
PID 2212 wrote to memory of 488	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	8
PID 2212 wrote to memory of 600	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	9
PID 2212 wrote to memory of 600	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	9
PID 2212 wrote to memory of 600	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	9
PID 2212 wrote to memory of 600	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	9
PID 2212 wrote to memory of 600	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	9
PID 2212 wrote to memory of 600	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	9
PID 2212 wrote to memory of 600	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	9
PID 2212 wrote to memory of 676	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	10
PID 2212 wrote to memory of 676	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	10
PID 2212 wrote to memory of 676	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	10
PID 2212 wrote to memory of 676	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	10
PID 2212 wrote to memory of 676	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	10
PID 2212 wrote to memory of 676	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	10
PID 2212 wrote to memory of 676	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	10
PID 2212 wrote to memory of 740	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	11
PID 2212 wrote to memory of 740	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	11
PID 2212 wrote to memory of 740	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	11
PID 2212 wrote to memory of 740	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	11
PID 2212 wrote to memory of 740	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	11
PID 2212 wrote to memory of 740	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	11
PID 2212 wrote to memory of 740	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	11
PID 2212 wrote to memory of 812	2212	cbf0816c1d4f0f42594c7443df3503f3.exe	12

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:372
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:464
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:600
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:1936
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:676
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:740
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:812
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1172
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:848
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:968
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:276
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:1032
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1092
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1136
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:1756
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:1152
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:480
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:488

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:380

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1220
- C:\Users\Admin\AppData\Local\Temp\cbf0816c1d4f0f42594c7443df3503f3.exe
  "C:\Users\Admin\AppData\Local\Temp\cbf0816c1d4f0f42594c7443df3503f3.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2212

C:\Users\Admin\AppData\Local\Temp\621311806\zmstage.exe
C:\Users\Admin\AppData\Local\Temp\621311806\zmstage.exe
1⤵
PID:3000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2212-0-0x0000000001000000-0x0000000001018000-memory.dmp

Filesize
96KB

Download
memory/2212-1-0x0000000001000000-0x0000000001018000-memory.dmp

Filesize
96KB

Download