aa75bf433436351b2179700ed5991aaa9a430599759911e7359bdf76f24c9a10

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
19-03-2024 11:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6010682fee402bfdcb501cecf283a9b.exe
Size

248KB
MD5

d6010682fee402bfdcb501cecf283a9b
SHA1

f3fe52bd1e46459d3739da335d0c7fedd2246edb
SHA256

aa75bf433436351b2179700ed5991aaa9a430599759911e7359bdf76f24c9a10
SHA512

3e5888a12317e51932eadcde8b42f74b0fb6f28e50b7654c268c4f912ff9a0cc4c45aecd3b308eea616289c33ea50f0a9cbf45c7fbd3dd15f965eed9a5aa450d
SSDEEP

6144:HFQoZzOQNqsV7uObtHq045DJwsDIkdXG:HFb887uO745DY

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2700-0-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral1/memory/2700-3-0x0000000000400000-0x000000000044C000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2700	d6010682fee402bfdcb501cecf283a9b.exe

Suspicious behavior: MapViewOfSection 21 IoCs

pid	Process
2700	d6010682fee402bfdcb501cecf283a9b.exe
2700	d6010682fee402bfdcb501cecf283a9b.exe
2700	d6010682fee402bfdcb501cecf283a9b.exe
2700	d6010682fee402bfdcb501cecf283a9b.exe
2700	d6010682fee402bfdcb501cecf283a9b.exe
2700	d6010682fee402bfdcb501cecf283a9b.exe
2700	d6010682fee402bfdcb501cecf283a9b.exe
2700	d6010682fee402bfdcb501cecf283a9b.exe
2700	d6010682fee402bfdcb501cecf283a9b.exe
2700	d6010682fee402bfdcb501cecf283a9b.exe
2700	d6010682fee402bfdcb501cecf283a9b.exe
2700	d6010682fee402bfdcb501cecf283a9b.exe
2700	d6010682fee402bfdcb501cecf283a9b.exe
2700	d6010682fee402bfdcb501cecf283a9b.exe
2700	d6010682fee402bfdcb501cecf283a9b.exe
2700	d6010682fee402bfdcb501cecf283a9b.exe
2700	d6010682fee402bfdcb501cecf283a9b.exe
2700	d6010682fee402bfdcb501cecf283a9b.exe
2700	d6010682fee402bfdcb501cecf283a9b.exe
2700	d6010682fee402bfdcb501cecf283a9b.exe
2700	d6010682fee402bfdcb501cecf283a9b.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2700	d6010682fee402bfdcb501cecf283a9b.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 388	2700	d6010682fee402bfdcb501cecf283a9b.exe	3
PID 2700 wrote to memory of 388	2700	d6010682fee402bfdcb501cecf283a9b.exe	3
PID 2700 wrote to memory of 388	2700	d6010682fee402bfdcb501cecf283a9b.exe	3
PID 2700 wrote to memory of 388	2700	d6010682fee402bfdcb501cecf283a9b.exe	3
PID 2700 wrote to memory of 388	2700	d6010682fee402bfdcb501cecf283a9b.exe	3
PID 2700 wrote to memory of 400	2700	d6010682fee402bfdcb501cecf283a9b.exe	4
PID 2700 wrote to memory of 400	2700	d6010682fee402bfdcb501cecf283a9b.exe	4
PID 2700 wrote to memory of 400	2700	d6010682fee402bfdcb501cecf283a9b.exe	4
PID 2700 wrote to memory of 400	2700	d6010682fee402bfdcb501cecf283a9b.exe	4
PID 2700 wrote to memory of 400	2700	d6010682fee402bfdcb501cecf283a9b.exe	4
PID 2700 wrote to memory of 436	2700	d6010682fee402bfdcb501cecf283a9b.exe	5
PID 2700 wrote to memory of 436	2700	d6010682fee402bfdcb501cecf283a9b.exe	5
PID 2700 wrote to memory of 436	2700	d6010682fee402bfdcb501cecf283a9b.exe	5
PID 2700 wrote to memory of 436	2700	d6010682fee402bfdcb501cecf283a9b.exe	5
PID 2700 wrote to memory of 436	2700	d6010682fee402bfdcb501cecf283a9b.exe	5
PID 2700 wrote to memory of 480	2700	d6010682fee402bfdcb501cecf283a9b.exe	6
PID 2700 wrote to memory of 480	2700	d6010682fee402bfdcb501cecf283a9b.exe	6
PID 2700 wrote to memory of 480	2700	d6010682fee402bfdcb501cecf283a9b.exe	6
PID 2700 wrote to memory of 480	2700	d6010682fee402bfdcb501cecf283a9b.exe	6
PID 2700 wrote to memory of 480	2700	d6010682fee402bfdcb501cecf283a9b.exe	6
PID 2700 wrote to memory of 496	2700	d6010682fee402bfdcb501cecf283a9b.exe	7
PID 2700 wrote to memory of 496	2700	d6010682fee402bfdcb501cecf283a9b.exe	7
PID 2700 wrote to memory of 496	2700	d6010682fee402bfdcb501cecf283a9b.exe	7
PID 2700 wrote to memory of 496	2700	d6010682fee402bfdcb501cecf283a9b.exe	7
PID 2700 wrote to memory of 496	2700	d6010682fee402bfdcb501cecf283a9b.exe	7
PID 2700 wrote to memory of 504	2700	d6010682fee402bfdcb501cecf283a9b.exe	8
PID 2700 wrote to memory of 504	2700	d6010682fee402bfdcb501cecf283a9b.exe	8
PID 2700 wrote to memory of 504	2700	d6010682fee402bfdcb501cecf283a9b.exe	8
PID 2700 wrote to memory of 504	2700	d6010682fee402bfdcb501cecf283a9b.exe	8
PID 2700 wrote to memory of 504	2700	d6010682fee402bfdcb501cecf283a9b.exe	8
PID 2700 wrote to memory of 608	2700	d6010682fee402bfdcb501cecf283a9b.exe	9
PID 2700 wrote to memory of 608	2700	d6010682fee402bfdcb501cecf283a9b.exe	9
PID 2700 wrote to memory of 608	2700	d6010682fee402bfdcb501cecf283a9b.exe	9
PID 2700 wrote to memory of 608	2700	d6010682fee402bfdcb501cecf283a9b.exe	9
PID 2700 wrote to memory of 608	2700	d6010682fee402bfdcb501cecf283a9b.exe	9
PID 2700 wrote to memory of 684	2700	d6010682fee402bfdcb501cecf283a9b.exe	10
PID 2700 wrote to memory of 684	2700	d6010682fee402bfdcb501cecf283a9b.exe	10
PID 2700 wrote to memory of 684	2700	d6010682fee402bfdcb501cecf283a9b.exe	10
PID 2700 wrote to memory of 684	2700	d6010682fee402bfdcb501cecf283a9b.exe	10
PID 2700 wrote to memory of 684	2700	d6010682fee402bfdcb501cecf283a9b.exe	10
PID 2700 wrote to memory of 756	2700	d6010682fee402bfdcb501cecf283a9b.exe	11
PID 2700 wrote to memory of 756	2700	d6010682fee402bfdcb501cecf283a9b.exe	11
PID 2700 wrote to memory of 756	2700	d6010682fee402bfdcb501cecf283a9b.exe	11
PID 2700 wrote to memory of 756	2700	d6010682fee402bfdcb501cecf283a9b.exe	11
PID 2700 wrote to memory of 756	2700	d6010682fee402bfdcb501cecf283a9b.exe	11
PID 2700 wrote to memory of 824	2700	d6010682fee402bfdcb501cecf283a9b.exe	12
PID 2700 wrote to memory of 824	2700	d6010682fee402bfdcb501cecf283a9b.exe	12
PID 2700 wrote to memory of 824	2700	d6010682fee402bfdcb501cecf283a9b.exe	12
PID 2700 wrote to memory of 824	2700	d6010682fee402bfdcb501cecf283a9b.exe	12
PID 2700 wrote to memory of 824	2700	d6010682fee402bfdcb501cecf283a9b.exe	12
PID 2700 wrote to memory of 864	2700	d6010682fee402bfdcb501cecf283a9b.exe	13
PID 2700 wrote to memory of 864	2700	d6010682fee402bfdcb501cecf283a9b.exe	13
PID 2700 wrote to memory of 864	2700	d6010682fee402bfdcb501cecf283a9b.exe	13
PID 2700 wrote to memory of 864	2700	d6010682fee402bfdcb501cecf283a9b.exe	13
PID 2700 wrote to memory of 864	2700	d6010682fee402bfdcb501cecf283a9b.exe	13
PID 2700 wrote to memory of 976	2700	d6010682fee402bfdcb501cecf283a9b.exe	15
PID 2700 wrote to memory of 976	2700	d6010682fee402bfdcb501cecf283a9b.exe	15
PID 2700 wrote to memory of 976	2700	d6010682fee402bfdcb501cecf283a9b.exe	15
PID 2700 wrote to memory of 976	2700	d6010682fee402bfdcb501cecf283a9b.exe	15
PID 2700 wrote to memory of 976	2700	d6010682fee402bfdcb501cecf283a9b.exe	15
PID 2700 wrote to memory of 288	2700	d6010682fee402bfdcb501cecf283a9b.exe	16
PID 2700 wrote to memory of 288	2700	d6010682fee402bfdcb501cecf283a9b.exe	16
PID 2700 wrote to memory of 288	2700	d6010682fee402bfdcb501cecf283a9b.exe	16
PID 2700 wrote to memory of 288	2700	d6010682fee402bfdcb501cecf283a9b.exe	16

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:388
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:480
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:608
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:1488
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:684
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:756
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:824
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1140
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:864
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:976
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:288
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:1048
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1060
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1148
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:1216
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:2164
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:496
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:504

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:400

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:436

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1196
- C:\Users\Admin\AppData\Local\Temp\d6010682fee402bfdcb501cecf283a9b.exe
  "C:\Users\Admin\AppData\Local\Temp\d6010682fee402bfdcb501cecf283a9b.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2700-0-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2700-2-0x00000000774BF000-0x00000000774C0000-memory.dmp

Filesize
4KB

Download
memory/2700-1-0x00000000774C0000-0x00000000774C1000-memory.dmp

Filesize
4KB

Download
memory/2700-3-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download