2cc00a298c3bd523eace30d8740ab9d42bba63ce8cebcda5a3c3c52ac801a413

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-11-2024 02:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2cc00a298c3bd523eace30d8740ab9d42bba63ce8cebcda5a3c3c52ac801a413.exe
Size

948KB
MD5

1a74c66d4750248af37fe8cb959560cd
SHA1

8d4de0fd49e567ed59ff6e0efb62ff43de76e841
SHA256

2cc00a298c3bd523eace30d8740ab9d42bba63ce8cebcda5a3c3c52ac801a413
SHA512

5b7cb8215e5b089c16bdb27207399ba2f059862272f8e4125858940a910581e48c7ade8c9c0fca2bc9ce13c06a76692da582c5246ec9add660ff96420ff48874
SSDEEP

24576:sGF+CJcIc+trkIpbcf1luQnZ/uzzFxiXKjoeKxEfDhI5/3:DxcIfrxC1EQZczFoajoeKic/

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ApplicationUrl.vbs	2cc00a298c3bd523eace30d8740ab9d42bba63ce8cebcda5a3c3c52ac801a413.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2224	2cc00a298c3bd523eace30d8740ab9d42bba63ce8cebcda5a3c3c52ac801a413.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2224	2cc00a298c3bd523eace30d8740ab9d42bba63ce8cebcda5a3c3c52ac801a413.exe
Token: SeDebugPrivilege	2224	2cc00a298c3bd523eace30d8740ab9d42bba63ce8cebcda5a3c3c52ac801a413.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 5812	2224	2cc00a298c3bd523eace30d8740ab9d42bba63ce8cebcda5a3c3c52ac801a413.exe	30
PID 2224 wrote to memory of 5812	2224	2cc00a298c3bd523eace30d8740ab9d42bba63ce8cebcda5a3c3c52ac801a413.exe	30
PID 2224 wrote to memory of 5812	2224	2cc00a298c3bd523eace30d8740ab9d42bba63ce8cebcda5a3c3c52ac801a413.exe	30

C:\Users\Admin\AppData\Local\Temp\2cc00a298c3bd523eace30d8740ab9d42bba63ce8cebcda5a3c3c52ac801a413.exe
"C:\Users\Admin\AppData\Local\Temp\2cc00a298c3bd523eace30d8740ab9d42bba63ce8cebcda5a3c3c52ac801a413.exe"
1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2224 -s 632
  2⤵
  PID:5812

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2224-0-0x000007FEF5693000-0x000007FEF5694000-memory.dmp

Filesize
4KB

Download
memory/2224-1-0x00000000002F0000-0x00000000003E2000-memory.dmp

Filesize
968KB

Download
memory/2224-2-0x000000001C0B0000-0x000000001C19E000-memory.dmp

Filesize
952KB

Download
memory/2224-3-0x000007FEF5690000-0x000007FEF607C000-memory.dmp

Filesize
9.9MB

Download
memory/2224-4-0x000000001C0B0000-0x000000001C199000-memory.dmp

Filesize
932KB

Download
memory/2224-11-0x000000001C0B0000-0x000000001C199000-memory.dmp

Filesize
932KB

Download
memory/2224-23-0x000000001C0B0000-0x000000001C199000-memory.dmp

Filesize
932KB

Download
memory/2224-41-0x000000001C0B0000-0x000000001C199000-memory.dmp

Filesize
932KB

Download
memory/2224-39-0x000000001C0B0000-0x000000001C199000-memory.dmp

Filesize
932KB

Download
memory/2224-37-0x000000001C0B0000-0x000000001C199000-memory.dmp

Filesize
932KB

Download
memory/2224-35-0x000000001C0B0000-0x000000001C199000-memory.dmp

Filesize
932KB

Download
memory/2224-33-0x000000001C0B0000-0x000000001C199000-memory.dmp

Filesize
932KB

Download
memory/2224-31-0x000000001C0B0000-0x000000001C199000-memory.dmp

Filesize
932KB

Download
memory/2224-29-0x000000001C0B0000-0x000000001C199000-memory.dmp

Filesize
932KB

Download
memory/2224-27-0x000000001C0B0000-0x000000001C199000-memory.dmp

Filesize
932KB

Download
memory/2224-25-0x000000001C0B0000-0x000000001C199000-memory.dmp

Filesize
932KB

Download
memory/2224-21-0x000000001C0B0000-0x000000001C199000-memory.dmp

Filesize
932KB

Download
memory/2224-19-0x000000001C0B0000-0x000000001C199000-memory.dmp

Filesize
932KB

Download
memory/2224-17-0x000000001C0B0000-0x000000001C199000-memory.dmp

Filesize
932KB

Download
memory/2224-15-0x000000001C0B0000-0x000000001C199000-memory.dmp

Filesize
932KB

Download
memory/2224-13-0x000000001C0B0000-0x000000001C199000-memory.dmp

Filesize
932KB

Download
memory/2224-9-0x000000001C0B0000-0x000000001C199000-memory.dmp

Filesize
932KB

Download
memory/2224-7-0x000000001C0B0000-0x000000001C199000-memory.dmp

Filesize
932KB

Download
memory/2224-6-0x000000001C0B0000-0x000000001C199000-memory.dmp

Filesize
932KB

Download
memory/2224-43-0x000000001C0B0000-0x000000001C199000-memory.dmp

Filesize
932KB

Download
memory/2224-53-0x000000001C0B0000-0x000000001C199000-memory.dmp

Filesize
932KB

Download
memory/2224-51-0x000000001C0B0000-0x000000001C199000-memory.dmp

Filesize
932KB

Download
memory/2224-49-0x000000001C0B0000-0x000000001C199000-memory.dmp

Filesize
932KB

Download
memory/2224-47-0x000000001C0B0000-0x000000001C199000-memory.dmp

Filesize
932KB

Download
memory/2224-45-0x000000001C0B0000-0x000000001C199000-memory.dmp

Filesize
932KB

Download
memory/2224-55-0x000000001C0B0000-0x000000001C199000-memory.dmp

Filesize
932KB

Download
memory/2224-59-0x000000001C0B0000-0x000000001C199000-memory.dmp

Filesize
932KB

Download
memory/2224-57-0x000000001C0B0000-0x000000001C199000-memory.dmp

Filesize
932KB

Download
memory/2224-61-0x000000001C0B0000-0x000000001C199000-memory.dmp

Filesize
932KB

Download
memory/2224-63-0x000000001C0B0000-0x000000001C199000-memory.dmp

Filesize
932KB

Download
memory/2224-65-0x000000001C0B0000-0x000000001C199000-memory.dmp

Filesize
932KB

Download
memory/2224-67-0x000000001C0B0000-0x000000001C199000-memory.dmp

Filesize
932KB

Download
memory/2224-1078-0x000007FEF5690000-0x000007FEF607C000-memory.dmp

Filesize
9.9MB

Download
memory/2224-1079-0x0000000002260000-0x00000000022C2000-memory.dmp

Filesize
392KB

Download
memory/2224-1080-0x0000000002470000-0x00000000024BC000-memory.dmp

Filesize
304KB

Download
memory/2224-1081-0x000000001AC40000-0x000000001AC94000-memory.dmp

Filesize
336KB

Download
memory/2224-1083-0x000007FEF5690000-0x000007FEF607C000-memory.dmp

Filesize
9.9MB

Download
memory/2224-1085-0x000007FEF5690000-0x000007FEF607C000-memory.dmp

Filesize
9.9MB

Download
memory/2224-1086-0x000007FEF5690000-0x000007FEF607C000-memory.dmp

Filesize
9.9MB

Download