e24b3427629aaddef6c67d7fc6ffa0087b1e8c04e8cb826bb698d60a7819a002

Analysis

max time kernel
17s
max time network
18s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 23:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

268613f9cc926f5a1d005662e5717050N.exe
Size

51KB
MD5

268613f9cc926f5a1d005662e5717050
SHA1

576ced2d328e64d3905911dad2671e367b0fd1a3
SHA256

e24b3427629aaddef6c67d7fc6ffa0087b1e8c04e8cb826bb698d60a7819a002
SHA512

3fbc2056f0b0073975ffe4403097b5cf471841b204fb914ab222de5717675aae2deb97ad0bc7bbb12ad4f53326bc63345aebcf4c5e8b4ca578760d48ca8076ba
SSDEEP

1536:GSY+A37feaCMJDmYsLIb4PvYqHB/AdG2mhA0a:GSDADeak7dJHB/AdG2h

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2420	268613f9cc926f5a1d005662e5717050N.exe

Suspicious behavior: MapViewOfSection 23 IoCs

pid	Process
2420	268613f9cc926f5a1d005662e5717050N.exe
2420	268613f9cc926f5a1d005662e5717050N.exe
2420	268613f9cc926f5a1d005662e5717050N.exe
2420	268613f9cc926f5a1d005662e5717050N.exe
2420	268613f9cc926f5a1d005662e5717050N.exe
2420	268613f9cc926f5a1d005662e5717050N.exe
2420	268613f9cc926f5a1d005662e5717050N.exe
2420	268613f9cc926f5a1d005662e5717050N.exe
2420	268613f9cc926f5a1d005662e5717050N.exe
2420	268613f9cc926f5a1d005662e5717050N.exe
2420	268613f9cc926f5a1d005662e5717050N.exe
2420	268613f9cc926f5a1d005662e5717050N.exe
2420	268613f9cc926f5a1d005662e5717050N.exe
2420	268613f9cc926f5a1d005662e5717050N.exe
2420	268613f9cc926f5a1d005662e5717050N.exe
2420	268613f9cc926f5a1d005662e5717050N.exe
2420	268613f9cc926f5a1d005662e5717050N.exe
2420	268613f9cc926f5a1d005662e5717050N.exe
2420	268613f9cc926f5a1d005662e5717050N.exe
2420	268613f9cc926f5a1d005662e5717050N.exe
2420	268613f9cc926f5a1d005662e5717050N.exe
2420	268613f9cc926f5a1d005662e5717050N.exe
2420	268613f9cc926f5a1d005662e5717050N.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2420	268613f9cc926f5a1d005662e5717050N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 384	2420	268613f9cc926f5a1d005662e5717050N.exe	3
PID 2420 wrote to memory of 384	2420	268613f9cc926f5a1d005662e5717050N.exe	3
PID 2420 wrote to memory of 384	2420	268613f9cc926f5a1d005662e5717050N.exe	3
PID 2420 wrote to memory of 384	2420	268613f9cc926f5a1d005662e5717050N.exe	3
PID 2420 wrote to memory of 384	2420	268613f9cc926f5a1d005662e5717050N.exe	3
PID 2420 wrote to memory of 396	2420	268613f9cc926f5a1d005662e5717050N.exe	4
PID 2420 wrote to memory of 396	2420	268613f9cc926f5a1d005662e5717050N.exe	4
PID 2420 wrote to memory of 396	2420	268613f9cc926f5a1d005662e5717050N.exe	4
PID 2420 wrote to memory of 396	2420	268613f9cc926f5a1d005662e5717050N.exe	4
PID 2420 wrote to memory of 396	2420	268613f9cc926f5a1d005662e5717050N.exe	4
PID 2420 wrote to memory of 432	2420	268613f9cc926f5a1d005662e5717050N.exe	5
PID 2420 wrote to memory of 432	2420	268613f9cc926f5a1d005662e5717050N.exe	5
PID 2420 wrote to memory of 432	2420	268613f9cc926f5a1d005662e5717050N.exe	5
PID 2420 wrote to memory of 432	2420	268613f9cc926f5a1d005662e5717050N.exe	5
PID 2420 wrote to memory of 432	2420	268613f9cc926f5a1d005662e5717050N.exe	5
PID 2420 wrote to memory of 476	2420	268613f9cc926f5a1d005662e5717050N.exe	6
PID 2420 wrote to memory of 476	2420	268613f9cc926f5a1d005662e5717050N.exe	6
PID 2420 wrote to memory of 476	2420	268613f9cc926f5a1d005662e5717050N.exe	6
PID 2420 wrote to memory of 476	2420	268613f9cc926f5a1d005662e5717050N.exe	6
PID 2420 wrote to memory of 476	2420	268613f9cc926f5a1d005662e5717050N.exe	6
PID 2420 wrote to memory of 492	2420	268613f9cc926f5a1d005662e5717050N.exe	7
PID 2420 wrote to memory of 492	2420	268613f9cc926f5a1d005662e5717050N.exe	7
PID 2420 wrote to memory of 492	2420	268613f9cc926f5a1d005662e5717050N.exe	7
PID 2420 wrote to memory of 492	2420	268613f9cc926f5a1d005662e5717050N.exe	7
PID 2420 wrote to memory of 492	2420	268613f9cc926f5a1d005662e5717050N.exe	7
PID 2420 wrote to memory of 500	2420	268613f9cc926f5a1d005662e5717050N.exe	8
PID 2420 wrote to memory of 500	2420	268613f9cc926f5a1d005662e5717050N.exe	8
PID 2420 wrote to memory of 500	2420	268613f9cc926f5a1d005662e5717050N.exe	8
PID 2420 wrote to memory of 500	2420	268613f9cc926f5a1d005662e5717050N.exe	8
PID 2420 wrote to memory of 500	2420	268613f9cc926f5a1d005662e5717050N.exe	8
PID 2420 wrote to memory of 612	2420	268613f9cc926f5a1d005662e5717050N.exe	9
PID 2420 wrote to memory of 612	2420	268613f9cc926f5a1d005662e5717050N.exe	9
PID 2420 wrote to memory of 612	2420	268613f9cc926f5a1d005662e5717050N.exe	9
PID 2420 wrote to memory of 612	2420	268613f9cc926f5a1d005662e5717050N.exe	9
PID 2420 wrote to memory of 612	2420	268613f9cc926f5a1d005662e5717050N.exe	9
PID 2420 wrote to memory of 688	2420	268613f9cc926f5a1d005662e5717050N.exe	10
PID 2420 wrote to memory of 688	2420	268613f9cc926f5a1d005662e5717050N.exe	10
PID 2420 wrote to memory of 688	2420	268613f9cc926f5a1d005662e5717050N.exe	10
PID 2420 wrote to memory of 688	2420	268613f9cc926f5a1d005662e5717050N.exe	10
PID 2420 wrote to memory of 688	2420	268613f9cc926f5a1d005662e5717050N.exe	10
PID 2420 wrote to memory of 772	2420	268613f9cc926f5a1d005662e5717050N.exe	11
PID 2420 wrote to memory of 772	2420	268613f9cc926f5a1d005662e5717050N.exe	11
PID 2420 wrote to memory of 772	2420	268613f9cc926f5a1d005662e5717050N.exe	11
PID 2420 wrote to memory of 772	2420	268613f9cc926f5a1d005662e5717050N.exe	11
PID 2420 wrote to memory of 772	2420	268613f9cc926f5a1d005662e5717050N.exe	11
PID 2420 wrote to memory of 832	2420	268613f9cc926f5a1d005662e5717050N.exe	12
PID 2420 wrote to memory of 832	2420	268613f9cc926f5a1d005662e5717050N.exe	12
PID 2420 wrote to memory of 832	2420	268613f9cc926f5a1d005662e5717050N.exe	12
PID 2420 wrote to memory of 832	2420	268613f9cc926f5a1d005662e5717050N.exe	12
PID 2420 wrote to memory of 832	2420	268613f9cc926f5a1d005662e5717050N.exe	12
PID 2420 wrote to memory of 872	2420	268613f9cc926f5a1d005662e5717050N.exe	13
PID 2420 wrote to memory of 872	2420	268613f9cc926f5a1d005662e5717050N.exe	13
PID 2420 wrote to memory of 872	2420	268613f9cc926f5a1d005662e5717050N.exe	13
PID 2420 wrote to memory of 872	2420	268613f9cc926f5a1d005662e5717050N.exe	13
PID 2420 wrote to memory of 872	2420	268613f9cc926f5a1d005662e5717050N.exe	13
PID 2420 wrote to memory of 984	2420	268613f9cc926f5a1d005662e5717050N.exe	15
PID 2420 wrote to memory of 984	2420	268613f9cc926f5a1d005662e5717050N.exe	15
PID 2420 wrote to memory of 984	2420	268613f9cc926f5a1d005662e5717050N.exe	15
PID 2420 wrote to memory of 984	2420	268613f9cc926f5a1d005662e5717050N.exe	15
PID 2420 wrote to memory of 984	2420	268613f9cc926f5a1d005662e5717050N.exe	15
PID 2420 wrote to memory of 300	2420	268613f9cc926f5a1d005662e5717050N.exe	16
PID 2420 wrote to memory of 300	2420	268613f9cc926f5a1d005662e5717050N.exe	16
PID 2420 wrote to memory of 300	2420	268613f9cc926f5a1d005662e5717050N.exe	16
PID 2420 wrote to memory of 300	2420	268613f9cc926f5a1d005662e5717050N.exe	16

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:384
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:476
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:612
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe
      4⤵
      PID:1532
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:288
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:688
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:772
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:832
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1156
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:872
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:984
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:300
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:1068
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1080
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1148
- - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    3⤵
    PID:1196
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:2304
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:2296
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:492
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:500

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:396

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1200
- C:\Users\Admin\AppData\Local\Temp\268613f9cc926f5a1d005662e5717050N.exe
  "C:\Users\Admin\AppData\Local\Temp\268613f9cc926f5a1d005662e5717050N.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2420-2-0x0000000076F6F000-0x0000000076F70000-memory.dmp

Filesize
4KB

Download
memory/2420-1-0x0000000076F70000-0x0000000076F71000-memory.dmp

Filesize
4KB

Download
memory/2420-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download