4ce4c6be9047906d780fcee638dc5fce92a790c8185ae2a198f03edc825354dc

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 19:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

dff61e93aa11c2b7ad6a2a751c349ba4.exe
Size

180KB
MD5

dff61e93aa11c2b7ad6a2a751c349ba4
SHA1

30e2bf1f1941ddb78c0a6a94f8d4faf516331654
SHA256

4ce4c6be9047906d780fcee638dc5fce92a790c8185ae2a198f03edc825354dc
SHA512

8247a1a9af18e0a533a66e61253ac943a087fb4de478218da3a4fa3d247f12203e8e5fd4455b3684669f4a9e4bcb6b1554b450f570df70390dfa84c9fc0cc8cd
SSDEEP

3072:dwHi+R3eBewbLFjWqNxg5X2M1GrO7P/aOZC57iEOg6A6aclpHsczyIJ:6zsbLFLNxgp2q27xOk6VrhyI

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2168-0-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral1/memory/2168-5-0x0000000000400000-0x000000000044C000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe

Suspicious behavior: MapViewOfSection 21 IoCs

pid	Process
2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe
2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe
2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe
2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe
2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe
2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe
2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe
2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe
2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe
2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe
2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe
2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe
2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe
2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe
2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe
2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe
2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe
2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe
2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe
2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe
2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 388	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	3
PID 2168 wrote to memory of 388	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	3
PID 2168 wrote to memory of 388	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	3
PID 2168 wrote to memory of 388	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	3
PID 2168 wrote to memory of 388	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	3
PID 2168 wrote to memory of 388	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	3
PID 2168 wrote to memory of 388	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	3
PID 2168 wrote to memory of 396	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	4
PID 2168 wrote to memory of 396	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	4
PID 2168 wrote to memory of 396	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	4
PID 2168 wrote to memory of 396	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	4
PID 2168 wrote to memory of 396	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	4
PID 2168 wrote to memory of 396	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	4
PID 2168 wrote to memory of 396	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	4
PID 2168 wrote to memory of 436	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	5
PID 2168 wrote to memory of 436	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	5
PID 2168 wrote to memory of 436	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	5
PID 2168 wrote to memory of 436	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	5
PID 2168 wrote to memory of 436	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	5
PID 2168 wrote to memory of 436	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	5
PID 2168 wrote to memory of 436	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	5
PID 2168 wrote to memory of 480	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	6
PID 2168 wrote to memory of 480	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	6
PID 2168 wrote to memory of 480	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	6
PID 2168 wrote to memory of 480	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	6
PID 2168 wrote to memory of 480	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	6
PID 2168 wrote to memory of 480	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	6
PID 2168 wrote to memory of 480	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	6
PID 2168 wrote to memory of 496	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	7
PID 2168 wrote to memory of 496	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	7
PID 2168 wrote to memory of 496	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	7
PID 2168 wrote to memory of 496	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	7
PID 2168 wrote to memory of 496	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	7
PID 2168 wrote to memory of 496	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	7
PID 2168 wrote to memory of 496	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	7
PID 2168 wrote to memory of 504	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	8
PID 2168 wrote to memory of 504	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	8
PID 2168 wrote to memory of 504	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	8
PID 2168 wrote to memory of 504	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	8
PID 2168 wrote to memory of 504	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	8
PID 2168 wrote to memory of 504	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	8
PID 2168 wrote to memory of 504	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	8
PID 2168 wrote to memory of 596	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	9
PID 2168 wrote to memory of 596	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	9
PID 2168 wrote to memory of 596	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	9
PID 2168 wrote to memory of 596	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	9
PID 2168 wrote to memory of 596	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	9
PID 2168 wrote to memory of 596	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	9
PID 2168 wrote to memory of 596	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	9
PID 2168 wrote to memory of 680	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	10
PID 2168 wrote to memory of 680	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	10
PID 2168 wrote to memory of 680	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	10
PID 2168 wrote to memory of 680	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	10
PID 2168 wrote to memory of 680	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	10
PID 2168 wrote to memory of 680	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	10
PID 2168 wrote to memory of 680	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	10
PID 2168 wrote to memory of 752	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	11
PID 2168 wrote to memory of 752	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	11
PID 2168 wrote to memory of 752	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	11
PID 2168 wrote to memory of 752	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	11
PID 2168 wrote to memory of 752	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	11
PID 2168 wrote to memory of 752	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	11
PID 2168 wrote to memory of 752	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	11
PID 2168 wrote to memory of 820	2168	dff61e93aa11c2b7ad6a2a751c349ba4.exe	12

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:388
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:480
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:596
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:1544
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:680
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:752
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:820
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1076
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:856
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:968
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:276
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:1056
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1068
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1132
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:2268
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:2012
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:496
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:504

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:396

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:436

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1172
- C:\Users\Admin\AppData\Local\Temp\dff61e93aa11c2b7ad6a2a751c349ba4.exe
  "C:\Users\Admin\AppData\Local\Temp\dff61e93aa11c2b7ad6a2a751c349ba4.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2168

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2168-0-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2168-1-0x00000000773DF000-0x00000000773E0000-memory.dmp

Filesize
4KB

Download
memory/2168-2-0x00000000773E0000-0x00000000773E1000-memory.dmp

Filesize
4KB

Download
memory/2168-5-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download