Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 08:59
Static task
static1
Behavioral task
behavioral1
Sample
v0hRSGca3D2Z7cW.exe
Resource
win7-20240215-en
windows7-x64
3 signatures
150 seconds
General
-
Target
v0hRSGca3D2Z7cW.exe
-
Size
779KB
-
MD5
79869ac2557f532c7db50785f59f8057
-
SHA1
4458bc01d37a3a3feb24b8da5b9f8190356c59d8
-
SHA256
6465b2c5702a723c7229e33fdf38676e3b0e0049b5b632e2fe6e210713f6a7e7
-
SHA512
b2079da931d878accc6c2f7f81f07b313689bcbeccb7319a3b1fac7dcf3abfc44406a40d48215bd8d74519bed1d266a3ccb81549b5fe14bd41c4600698647fea
-
SSDEEP
12288:HuqnHvjNIrpf9rN/mc/ChYgp70NtH95FYIqe17df6dFFHCApvlmJg0kR:H7PjKr5BNDUYgl8tdDY1qBf6d/HCApdr
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
v0hRSGca3D2Z7cW.exepid process 2952 v0hRSGca3D2Z7cW.exe 2952 v0hRSGca3D2Z7cW.exe 2952 v0hRSGca3D2Z7cW.exe 2952 v0hRSGca3D2Z7cW.exe 2952 v0hRSGca3D2Z7cW.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
v0hRSGca3D2Z7cW.exedescription pid process Token: SeDebugPrivilege 2952 v0hRSGca3D2Z7cW.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
v0hRSGca3D2Z7cW.exedescription pid process target process PID 2952 wrote to memory of 1288 2952 v0hRSGca3D2Z7cW.exe v0hRSGca3D2Z7cW.exe PID 2952 wrote to memory of 1288 2952 v0hRSGca3D2Z7cW.exe v0hRSGca3D2Z7cW.exe PID 2952 wrote to memory of 1288 2952 v0hRSGca3D2Z7cW.exe v0hRSGca3D2Z7cW.exe PID 2952 wrote to memory of 1288 2952 v0hRSGca3D2Z7cW.exe v0hRSGca3D2Z7cW.exe PID 2952 wrote to memory of 2528 2952 v0hRSGca3D2Z7cW.exe v0hRSGca3D2Z7cW.exe PID 2952 wrote to memory of 2528 2952 v0hRSGca3D2Z7cW.exe v0hRSGca3D2Z7cW.exe PID 2952 wrote to memory of 2528 2952 v0hRSGca3D2Z7cW.exe v0hRSGca3D2Z7cW.exe PID 2952 wrote to memory of 2528 2952 v0hRSGca3D2Z7cW.exe v0hRSGca3D2Z7cW.exe PID 2952 wrote to memory of 2260 2952 v0hRSGca3D2Z7cW.exe v0hRSGca3D2Z7cW.exe PID 2952 wrote to memory of 2260 2952 v0hRSGca3D2Z7cW.exe v0hRSGca3D2Z7cW.exe PID 2952 wrote to memory of 2260 2952 v0hRSGca3D2Z7cW.exe v0hRSGca3D2Z7cW.exe PID 2952 wrote to memory of 2260 2952 v0hRSGca3D2Z7cW.exe v0hRSGca3D2Z7cW.exe PID 2952 wrote to memory of 1340 2952 v0hRSGca3D2Z7cW.exe v0hRSGca3D2Z7cW.exe PID 2952 wrote to memory of 1340 2952 v0hRSGca3D2Z7cW.exe v0hRSGca3D2Z7cW.exe PID 2952 wrote to memory of 1340 2952 v0hRSGca3D2Z7cW.exe v0hRSGca3D2Z7cW.exe PID 2952 wrote to memory of 1340 2952 v0hRSGca3D2Z7cW.exe v0hRSGca3D2Z7cW.exe PID 2952 wrote to memory of 2060 2952 v0hRSGca3D2Z7cW.exe v0hRSGca3D2Z7cW.exe PID 2952 wrote to memory of 2060 2952 v0hRSGca3D2Z7cW.exe v0hRSGca3D2Z7cW.exe PID 2952 wrote to memory of 2060 2952 v0hRSGca3D2Z7cW.exe v0hRSGca3D2Z7cW.exe PID 2952 wrote to memory of 2060 2952 v0hRSGca3D2Z7cW.exe v0hRSGca3D2Z7cW.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\v0hRSGca3D2Z7cW.exe"C:\Users\Admin\AppData\Local\Temp\v0hRSGca3D2Z7cW.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\v0hRSGca3D2Z7cW.exe"C:\Users\Admin\AppData\Local\Temp\v0hRSGca3D2Z7cW.exe"2⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\v0hRSGca3D2Z7cW.exe"C:\Users\Admin\AppData\Local\Temp\v0hRSGca3D2Z7cW.exe"2⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\v0hRSGca3D2Z7cW.exe"C:\Users\Admin\AppData\Local\Temp\v0hRSGca3D2Z7cW.exe"2⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\v0hRSGca3D2Z7cW.exe"C:\Users\Admin\AppData\Local\Temp\v0hRSGca3D2Z7cW.exe"2⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\v0hRSGca3D2Z7cW.exe"C:\Users\Admin\AppData\Local\Temp\v0hRSGca3D2Z7cW.exe"2⤵PID:2060
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2952-0-0x00000000003A0000-0x0000000000464000-memory.dmpFilesize
784KB
-
memory/2952-1-0x0000000074AA0000-0x000000007518E000-memory.dmpFilesize
6.9MB
-
memory/2952-2-0x0000000004D60000-0x0000000004DA0000-memory.dmpFilesize
256KB
-
memory/2952-3-0x0000000000480000-0x00000000004A0000-memory.dmpFilesize
128KB
-
memory/2952-4-0x00000000004B0000-0x00000000004C4000-memory.dmpFilesize
80KB
-
memory/2952-5-0x0000000004E80000-0x0000000004EF6000-memory.dmpFilesize
472KB
-
memory/2952-6-0x0000000074AA0000-0x000000007518E000-memory.dmpFilesize
6.9MB