28ff1b45b5b868a146535ceb38f475b62d4bde1b87c343e04d83709a3a1b7157

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 08:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91589b168ec9d6434c5c5a381d9e6290N.exe
Size

1.2MB
MD5

91589b168ec9d6434c5c5a381d9e6290
SHA1

1f01e197e829290fb8764712953e9f34ff67b78a
SHA256

28ff1b45b5b868a146535ceb38f475b62d4bde1b87c343e04d83709a3a1b7157
SHA512

3faeb26ba460925574bdf6bb222cfe5a2d60e8bad9b671588b2c45ffa909f1a5ce2aa6b9ee9db923f54d0f73388e7d112fd055fd5fd68390e462213f0e8f5e00
SSDEEP

24576:Y0U6vGWQMFuobcLnplqb6qy3C2oR5VrAS58b:gpScjpcmn3CbR5NAS5

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2676	91589b168ec9d6434c5c5a381d9e6290N.exe

Suspicious behavior: MapViewOfSection 23 IoCs

pid	Process
2676	91589b168ec9d6434c5c5a381d9e6290N.exe
2676	91589b168ec9d6434c5c5a381d9e6290N.exe
2676	91589b168ec9d6434c5c5a381d9e6290N.exe
2676	91589b168ec9d6434c5c5a381d9e6290N.exe
2676	91589b168ec9d6434c5c5a381d9e6290N.exe
2676	91589b168ec9d6434c5c5a381d9e6290N.exe
2676	91589b168ec9d6434c5c5a381d9e6290N.exe
2676	91589b168ec9d6434c5c5a381d9e6290N.exe
2676	91589b168ec9d6434c5c5a381d9e6290N.exe
2676	91589b168ec9d6434c5c5a381d9e6290N.exe
2676	91589b168ec9d6434c5c5a381d9e6290N.exe
2676	91589b168ec9d6434c5c5a381d9e6290N.exe
2676	91589b168ec9d6434c5c5a381d9e6290N.exe
2676	91589b168ec9d6434c5c5a381d9e6290N.exe
2676	91589b168ec9d6434c5c5a381d9e6290N.exe
2676	91589b168ec9d6434c5c5a381d9e6290N.exe
2676	91589b168ec9d6434c5c5a381d9e6290N.exe
2676	91589b168ec9d6434c5c5a381d9e6290N.exe
2676	91589b168ec9d6434c5c5a381d9e6290N.exe
2676	91589b168ec9d6434c5c5a381d9e6290N.exe
2676	91589b168ec9d6434c5c5a381d9e6290N.exe
2676	91589b168ec9d6434c5c5a381d9e6290N.exe
2676	91589b168ec9d6434c5c5a381d9e6290N.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2676	91589b168ec9d6434c5c5a381d9e6290N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 380	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	3
PID 2676 wrote to memory of 380	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	3
PID 2676 wrote to memory of 380	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	3
PID 2676 wrote to memory of 380	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	3
PID 2676 wrote to memory of 380	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	3
PID 2676 wrote to memory of 380	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	3
PID 2676 wrote to memory of 380	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	3
PID 2676 wrote to memory of 396	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	4
PID 2676 wrote to memory of 396	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	4
PID 2676 wrote to memory of 396	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	4
PID 2676 wrote to memory of 396	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	4
PID 2676 wrote to memory of 396	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	4
PID 2676 wrote to memory of 396	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	4
PID 2676 wrote to memory of 396	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	4
PID 2676 wrote to memory of 432	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	5
PID 2676 wrote to memory of 432	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	5
PID 2676 wrote to memory of 432	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	5
PID 2676 wrote to memory of 432	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	5
PID 2676 wrote to memory of 432	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	5
PID 2676 wrote to memory of 432	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	5
PID 2676 wrote to memory of 432	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	5
PID 2676 wrote to memory of 476	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	6
PID 2676 wrote to memory of 476	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	6
PID 2676 wrote to memory of 476	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	6
PID 2676 wrote to memory of 476	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	6
PID 2676 wrote to memory of 476	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	6
PID 2676 wrote to memory of 476	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	6
PID 2676 wrote to memory of 476	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	6
PID 2676 wrote to memory of 492	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	7
PID 2676 wrote to memory of 492	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	7
PID 2676 wrote to memory of 492	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	7
PID 2676 wrote to memory of 492	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	7
PID 2676 wrote to memory of 492	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	7
PID 2676 wrote to memory of 492	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	7
PID 2676 wrote to memory of 492	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	7
PID 2676 wrote to memory of 500	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	8
PID 2676 wrote to memory of 500	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	8
PID 2676 wrote to memory of 500	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	8
PID 2676 wrote to memory of 500	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	8
PID 2676 wrote to memory of 500	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	8
PID 2676 wrote to memory of 500	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	8
PID 2676 wrote to memory of 500	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	8
PID 2676 wrote to memory of 592	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	9
PID 2676 wrote to memory of 592	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	9
PID 2676 wrote to memory of 592	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	9
PID 2676 wrote to memory of 592	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	9
PID 2676 wrote to memory of 592	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	9
PID 2676 wrote to memory of 592	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	9
PID 2676 wrote to memory of 592	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	9
PID 2676 wrote to memory of 672	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	10
PID 2676 wrote to memory of 672	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	10
PID 2676 wrote to memory of 672	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	10
PID 2676 wrote to memory of 672	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	10
PID 2676 wrote to memory of 672	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	10
PID 2676 wrote to memory of 672	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	10
PID 2676 wrote to memory of 672	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	10
PID 2676 wrote to memory of 748	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	11
PID 2676 wrote to memory of 748	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	11
PID 2676 wrote to memory of 748	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	11
PID 2676 wrote to memory of 748	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	11
PID 2676 wrote to memory of 748	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	11
PID 2676 wrote to memory of 748	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	11
PID 2676 wrote to memory of 748	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	11
PID 2676 wrote to memory of 816	2676	91589b168ec9d6434c5c5a381d9e6290N.exe	12

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:380
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:476
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:592
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:1292
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe
      4⤵
      PID:1704
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:672
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:748
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:816
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1156
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:852
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:964
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:108
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:1020
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1060
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1108
- - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    3⤵
    PID:1616
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:2392
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:2500
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:492
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:500

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:396

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1192
- C:\Users\Admin\AppData\Local\Temp\91589b168ec9d6434c5c5a381d9e6290N.exe
  "C:\Users\Admin\AppData\Local\Temp\91589b168ec9d6434c5c5a381d9e6290N.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2676-0-0x0000000001000000-0x0000000001132000-memory.dmp

Filesize
1.2MB

Download
memory/2676-2-0x00000000774D0000-0x00000000774D1000-memory.dmp

Filesize
4KB

Download
memory/2676-1-0x00000000774CF000-0x00000000774D0000-memory.dmp

Filesize
4KB

Download
memory/2676-3-0x0000000001000000-0x0000000001132000-memory.dmp

Filesize
1.2MB

Download