b1539e59786b84f24711199a82842c938d252433164a437d0fc2f0b9a9517077

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 15:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AWD_Doc.exe
Size

139KB
MD5

ec80bb801f8113daf41d1b8e15fa8e2e
SHA1

292b792b1bd60b0a17aff237a8d8fc2f0aa1f09c
SHA256

83544a1f58caad71a03ed0f6e99f787e23ff20229f0a4c03622797fe62843a1b
SHA512

797f6047ac736042bf081e55cf04f86a97abe444609b91f4c7fe14aa477b0f8a86c6c8f17a0f3de340bd5193b5a6fe94f71ce26f3e9d1d7a0b53c0d5410c06ff
SSDEEP

1536:JXEYsHcKIiGuxVlPTGEDnFCma93EtMkj+WL17h9B4OJY51NjDRWtPOW5vAQktlGZ:CFlkmnjil3Cf54Qm8r0DoOuae4/I

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1232	AWD_Doc.exe
1232	AWD_Doc.exe
1232	AWD_Doc.exe
1232	AWD_Doc.exe
1232	AWD_Doc.exe
1232	AWD_Doc.exe
1232	AWD_Doc.exe
1232	AWD_Doc.exe
1232	AWD_Doc.exe
1232	AWD_Doc.exe
1232	AWD_Doc.exe
1232	AWD_Doc.exe
1232	AWD_Doc.exe
1232	AWD_Doc.exe
1232	AWD_Doc.exe
1232	AWD_Doc.exe
1232	AWD_Doc.exe
1232	AWD_Doc.exe
1232	AWD_Doc.exe
1232	AWD_Doc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1232	AWD_Doc.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 2188	1232	AWD_Doc.exe	30
PID 1232 wrote to memory of 2188	1232	AWD_Doc.exe	30
PID 1232 wrote to memory of 2188	1232	AWD_Doc.exe	30
PID 1232 wrote to memory of 2188	1232	AWD_Doc.exe	30
PID 1232 wrote to memory of 2060	1232	AWD_Doc.exe	31
PID 1232 wrote to memory of 2060	1232	AWD_Doc.exe	31
PID 1232 wrote to memory of 2060	1232	AWD_Doc.exe	31
PID 1232 wrote to memory of 2060	1232	AWD_Doc.exe	31
PID 1232 wrote to memory of 1144	1232	AWD_Doc.exe	32
PID 1232 wrote to memory of 1144	1232	AWD_Doc.exe	32
PID 1232 wrote to memory of 1144	1232	AWD_Doc.exe	32
PID 1232 wrote to memory of 1144	1232	AWD_Doc.exe	32
PID 1232 wrote to memory of 2080	1232	AWD_Doc.exe	33
PID 1232 wrote to memory of 2080	1232	AWD_Doc.exe	33
PID 1232 wrote to memory of 2080	1232	AWD_Doc.exe	33
PID 1232 wrote to memory of 2080	1232	AWD_Doc.exe	33
PID 1232 wrote to memory of 2548	1232	AWD_Doc.exe	34
PID 1232 wrote to memory of 2548	1232	AWD_Doc.exe	34
PID 1232 wrote to memory of 2548	1232	AWD_Doc.exe	34
PID 1232 wrote to memory of 2548	1232	AWD_Doc.exe	34
PID 1232 wrote to memory of 1976	1232	AWD_Doc.exe	35
PID 1232 wrote to memory of 1976	1232	AWD_Doc.exe	35
PID 1232 wrote to memory of 1976	1232	AWD_Doc.exe	35
PID 1232 wrote to memory of 1976	1232	AWD_Doc.exe	35
PID 1232 wrote to memory of 2096	1232	AWD_Doc.exe	36
PID 1232 wrote to memory of 2096	1232	AWD_Doc.exe	36
PID 1232 wrote to memory of 2096	1232	AWD_Doc.exe	36
PID 1232 wrote to memory of 2096	1232	AWD_Doc.exe	36
PID 1232 wrote to memory of 2092	1232	AWD_Doc.exe	37
PID 1232 wrote to memory of 2092	1232	AWD_Doc.exe	37
PID 1232 wrote to memory of 2092	1232	AWD_Doc.exe	37
PID 1232 wrote to memory of 2092	1232	AWD_Doc.exe	37
PID 1232 wrote to memory of 2148	1232	AWD_Doc.exe	38
PID 1232 wrote to memory of 2148	1232	AWD_Doc.exe	38
PID 1232 wrote to memory of 2148	1232	AWD_Doc.exe	38
PID 1232 wrote to memory of 2148	1232	AWD_Doc.exe	38
PID 1232 wrote to memory of 3068	1232	AWD_Doc.exe	39
PID 1232 wrote to memory of 3068	1232	AWD_Doc.exe	39
PID 1232 wrote to memory of 3068	1232	AWD_Doc.exe	39
PID 1232 wrote to memory of 3068	1232	AWD_Doc.exe	39

C:\Users\Admin\AppData\Local\Temp\AWD_Doc.exe
"C:\Users\Admin\AppData\Local\Temp\AWD_Doc.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2188
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2060
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:1144
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2080
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2548
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:1976
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2096
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2092
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2148
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:3068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1232-0-0x000007FEF51E3000-0x000007FEF51E4000-memory.dmp

Filesize
4KB

Download
memory/1232-1-0x0000000000C20000-0x0000000000C48000-memory.dmp

Filesize
160KB

Download
memory/1232-2-0x000007FEF51E0000-0x000007FEF5BCC000-memory.dmp

Filesize
9.9MB

Download
memory/1232-3-0x00000000001C0000-0x00000000001CA000-memory.dmp

Filesize
40KB

Download
memory/1232-4-0x000007FEF51E0000-0x000007FEF5BCC000-memory.dmp

Filesize
9.9MB

Download