2cc00a298c3bd523eace30d8740ab9d42bba63ce8cebcda5a3c3c52ac801a413

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
13-11-2024 19:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2cc00a298c3bd523eace30d8740ab9d42bba63ce8cebcda5a3c3c52ac801a413.exe
Size

948KB
MD5

1a74c66d4750248af37fe8cb959560cd
SHA1

8d4de0fd49e567ed59ff6e0efb62ff43de76e841
SHA256

2cc00a298c3bd523eace30d8740ab9d42bba63ce8cebcda5a3c3c52ac801a413
SHA512

5b7cb8215e5b089c16bdb27207399ba2f059862272f8e4125858940a910581e48c7ade8c9c0fca2bc9ce13c06a76692da582c5246ec9add660ff96420ff48874
SSDEEP

24576:sGF+CJcIc+trkIpbcf1luQnZ/uzzFxiXKjoeKxEfDhI5/3:DxcIfrxC1EQZczFoajoeKic/

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ApplicationUrl.vbs	2cc00a298c3bd523eace30d8740ab9d42bba63ce8cebcda5a3c3c52ac801a413.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1556	2cc00a298c3bd523eace30d8740ab9d42bba63ce8cebcda5a3c3c52ac801a413.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1556	2cc00a298c3bd523eace30d8740ab9d42bba63ce8cebcda5a3c3c52ac801a413.exe
Token: SeDebugPrivilege	1556	2cc00a298c3bd523eace30d8740ab9d42bba63ce8cebcda5a3c3c52ac801a413.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 5892	1556	2cc00a298c3bd523eace30d8740ab9d42bba63ce8cebcda5a3c3c52ac801a413.exe	30
PID 1556 wrote to memory of 5892	1556	2cc00a298c3bd523eace30d8740ab9d42bba63ce8cebcda5a3c3c52ac801a413.exe	30
PID 1556 wrote to memory of 5892	1556	2cc00a298c3bd523eace30d8740ab9d42bba63ce8cebcda5a3c3c52ac801a413.exe	30

C:\Users\Admin\AppData\Local\Temp\2cc00a298c3bd523eace30d8740ab9d42bba63ce8cebcda5a3c3c52ac801a413.exe
"C:\Users\Admin\AppData\Local\Temp\2cc00a298c3bd523eace30d8740ab9d42bba63ce8cebcda5a3c3c52ac801a413.exe"
1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1556 -s 636
  2⤵
  PID:5892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1556-0-0x000007FEF58E3000-0x000007FEF58E4000-memory.dmp

Filesize
4KB

Download
memory/1556-1-0x0000000001190000-0x0000000001282000-memory.dmp

Filesize
968KB

Download
memory/1556-2-0x000000001B2D0000-0x000000001B3BE000-memory.dmp

Filesize
952KB

Download
memory/1556-3-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp

Filesize
9.9MB

Download
memory/1556-4-0x000000001B2D0000-0x000000001B3B9000-memory.dmp

Filesize
932KB

Download
memory/1556-5-0x000000001B2D0000-0x000000001B3B9000-memory.dmp

Filesize
932KB

Download
memory/1556-7-0x000000001B2D0000-0x000000001B3B9000-memory.dmp

Filesize
932KB

Download
memory/1556-9-0x000000001B2D0000-0x000000001B3B9000-memory.dmp

Filesize
932KB

Download
memory/1556-15-0x000000001B2D0000-0x000000001B3B9000-memory.dmp

Filesize
932KB

Download
memory/1556-17-0x000000001B2D0000-0x000000001B3B9000-memory.dmp

Filesize
932KB

Download
memory/1556-19-0x000000001B2D0000-0x000000001B3B9000-memory.dmp

Filesize
932KB

Download
memory/1556-21-0x000000001B2D0000-0x000000001B3B9000-memory.dmp

Filesize
932KB

Download
memory/1556-13-0x000000001B2D0000-0x000000001B3B9000-memory.dmp

Filesize
932KB

Download
memory/1556-11-0x000000001B2D0000-0x000000001B3B9000-memory.dmp

Filesize
932KB

Download
memory/1556-39-0x000000001B2D0000-0x000000001B3B9000-memory.dmp

Filesize
932KB

Download
memory/1556-23-0x000000001B2D0000-0x000000001B3B9000-memory.dmp

Filesize
932KB

Download
memory/1556-25-0x000000001B2D0000-0x000000001B3B9000-memory.dmp

Filesize
932KB

Download
memory/1556-29-0x000000001B2D0000-0x000000001B3B9000-memory.dmp

Filesize
932KB

Download
memory/1556-33-0x000000001B2D0000-0x000000001B3B9000-memory.dmp

Filesize
932KB

Download
memory/1556-67-0x000000001B2D0000-0x000000001B3B9000-memory.dmp

Filesize
932KB

Download
memory/1556-65-0x000000001B2D0000-0x000000001B3B9000-memory.dmp

Filesize
932KB

Download
memory/1556-63-0x000000001B2D0000-0x000000001B3B9000-memory.dmp

Filesize
932KB

Download
memory/1556-61-0x000000001B2D0000-0x000000001B3B9000-memory.dmp

Filesize
932KB

Download
memory/1556-59-0x000000001B2D0000-0x000000001B3B9000-memory.dmp

Filesize
932KB

Download
memory/1556-57-0x000000001B2D0000-0x000000001B3B9000-memory.dmp

Filesize
932KB

Download
memory/1556-55-0x000000001B2D0000-0x000000001B3B9000-memory.dmp

Filesize
932KB

Download
memory/1556-53-0x000000001B2D0000-0x000000001B3B9000-memory.dmp

Filesize
932KB

Download
memory/1556-51-0x000000001B2D0000-0x000000001B3B9000-memory.dmp

Filesize
932KB

Download
memory/1556-49-0x000000001B2D0000-0x000000001B3B9000-memory.dmp

Filesize
932KB

Download
memory/1556-47-0x000000001B2D0000-0x000000001B3B9000-memory.dmp

Filesize
932KB

Download
memory/1556-45-0x000000001B2D0000-0x000000001B3B9000-memory.dmp

Filesize
932KB

Download
memory/1556-43-0x000000001B2D0000-0x000000001B3B9000-memory.dmp

Filesize
932KB

Download
memory/1556-41-0x000000001B2D0000-0x000000001B3B9000-memory.dmp

Filesize
932KB

Download
memory/1556-1078-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp

Filesize
9.9MB

Download
memory/1556-37-0x000000001B2D0000-0x000000001B3B9000-memory.dmp

Filesize
932KB

Download
memory/1556-35-0x000000001B2D0000-0x000000001B3B9000-memory.dmp

Filesize
932KB

Download
memory/1556-31-0x000000001B2D0000-0x000000001B3B9000-memory.dmp

Filesize
932KB

Download
memory/1556-27-0x000000001B2D0000-0x000000001B3B9000-memory.dmp

Filesize
932KB

Download
memory/1556-1079-0x0000000000E30000-0x0000000000E92000-memory.dmp

Filesize
392KB

Download
memory/1556-1080-0x0000000002690000-0x00000000026DC000-memory.dmp

Filesize
304KB

Download
memory/1556-1081-0x00000000006F0000-0x0000000000744000-memory.dmp

Filesize
336KB

Download
memory/1556-1083-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp

Filesize
9.9MB

Download
memory/1556-1085-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp

Filesize
9.9MB

Download
memory/1556-1086-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp

Filesize
9.9MB

Download