6dbe9a6e92e3962725c30e1533f195da33329b089a537557b1c3571225969191

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-05-2024 09:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PO#34316_20240528.exe
Size

535KB
MD5

14510710e98b064e69ecb55e956b2efe
SHA1

8e4a25f4b78a9293e39bcfb67686e0e0a4e5873a
SHA256

6dbe9a6e92e3962725c30e1533f195da33329b089a537557b1c3571225969191
SHA512

76b3116a1deae0c18add797a8c078fa621303292abaeefcef3eb67e01ae2ea21945a272936a356e17bd4ac17b809b05fd6c90da6b67126bcf3827b5496789363
SSDEEP

12288:+KcAV/xf4MbNpcFC1f41Vk6EjRlHs4vBqzkR:HOC1okFjHs453

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

PO#34316_20240528.exe

pid process

1556 PO#34316_20240528.exe
1556 PO#34316_20240528.exe
1556 PO#34316_20240528.exe
1556 PO#34316_20240528.exe
1556 PO#34316_20240528.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

PO#34316_20240528.exe

description pid process

Token: SeDebugPrivilege 1556 PO#34316_20240528.exe

pid	process
1556	PO#34316_20240528.exe
1556	PO#34316_20240528.exe
1556	PO#34316_20240528.exe
1556	PO#34316_20240528.exe
1556	PO#34316_20240528.exe

description	pid	process
Token: SeDebugPrivilege	1556	PO#34316_20240528.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

PO#34316_20240528.exe

description	pid	process	target process
PID 1556 wrote to memory of 2520	1556	PO#34316_20240528.exe	PO#34316_20240528.exe
PID 1556 wrote to memory of 2520	1556	PO#34316_20240528.exe	PO#34316_20240528.exe
PID 1556 wrote to memory of 2520	1556	PO#34316_20240528.exe	PO#34316_20240528.exe
PID 1556 wrote to memory of 2520	1556	PO#34316_20240528.exe	PO#34316_20240528.exe
PID 1556 wrote to memory of 2564	1556	PO#34316_20240528.exe	PO#34316_20240528.exe
PID 1556 wrote to memory of 2564	1556	PO#34316_20240528.exe	PO#34316_20240528.exe
PID 1556 wrote to memory of 2564	1556	PO#34316_20240528.exe	PO#34316_20240528.exe
PID 1556 wrote to memory of 2564	1556	PO#34316_20240528.exe	PO#34316_20240528.exe
PID 1556 wrote to memory of 2568	1556	PO#34316_20240528.exe	PO#34316_20240528.exe
PID 1556 wrote to memory of 2568	1556	PO#34316_20240528.exe	PO#34316_20240528.exe
PID 1556 wrote to memory of 2568	1556	PO#34316_20240528.exe	PO#34316_20240528.exe
PID 1556 wrote to memory of 2568	1556	PO#34316_20240528.exe	PO#34316_20240528.exe
PID 1556 wrote to memory of 2600	1556	PO#34316_20240528.exe	PO#34316_20240528.exe
PID 1556 wrote to memory of 2600	1556	PO#34316_20240528.exe	PO#34316_20240528.exe
PID 1556 wrote to memory of 2600	1556	PO#34316_20240528.exe	PO#34316_20240528.exe
PID 1556 wrote to memory of 2600	1556	PO#34316_20240528.exe	PO#34316_20240528.exe
PID 1556 wrote to memory of 2604	1556	PO#34316_20240528.exe	PO#34316_20240528.exe
PID 1556 wrote to memory of 2604	1556	PO#34316_20240528.exe	PO#34316_20240528.exe
PID 1556 wrote to memory of 2604	1556	PO#34316_20240528.exe	PO#34316_20240528.exe
PID 1556 wrote to memory of 2604	1556	PO#34316_20240528.exe	PO#34316_20240528.exe

C:\Users\Admin\AppData\Local\Temp\PO#34316_20240528.exe
"C:\Users\Admin\AppData\Local\Temp\PO#34316_20240528.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1556

C:\Users\Admin\AppData\Local\Temp\PO#34316_20240528.exe
"C:\Users\Admin\AppData\Local\Temp\PO#34316_20240528.exe"
2⤵
PID:2520

C:\Users\Admin\AppData\Local\Temp\PO#34316_20240528.exe
"C:\Users\Admin\AppData\Local\Temp\PO#34316_20240528.exe"
2⤵
PID:2564

C:\Users\Admin\AppData\Local\Temp\PO#34316_20240528.exe
"C:\Users\Admin\AppData\Local\Temp\PO#34316_20240528.exe"
2⤵
PID:2568

C:\Users\Admin\AppData\Local\Temp\PO#34316_20240528.exe
"C:\Users\Admin\AppData\Local\Temp\PO#34316_20240528.exe"
2⤵
PID:2600

C:\Users\Admin\AppData\Local\Temp\PO#34316_20240528.exe
"C:\Users\Admin\AppData\Local\Temp\PO#34316_20240528.exe"
2⤵
PID:2604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1556-0-0x0000000074A2E000-0x0000000074A2F000-memory.dmp

Filesize
4KB

Download
memory/1556-1-0x0000000000200000-0x0000000000288000-memory.dmp

Filesize
544KB

Download
memory/1556-2-0x0000000074A20000-0x000000007510E000-memory.dmp

Filesize
6.9MB

Download
memory/1556-3-0x0000000000370000-0x0000000000386000-memory.dmp

Filesize
88KB

Download
memory/1556-4-0x0000000000610000-0x000000000061C000-memory.dmp

Filesize
48KB

Download
memory/1556-5-0x0000000000660000-0x0000000000670000-memory.dmp

Filesize
64KB

Download
memory/1556-6-0x0000000004F40000-0x0000000004FA2000-memory.dmp

Filesize
392KB

Download
memory/1556-7-0x0000000074A20000-0x000000007510E000-memory.dmp

Filesize
6.9MB

Download