96c7d1d5dab0c8060f3220816e3e49461ef328643d520545ffc8aa05ddd76760

Analysis

max time kernel
18s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
20-11-2024 17:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Winsvc.exe
Size

1.6MB
MD5

3e4461418de7a12e7951ccf51fe4d4d3
SHA1

d7332419080c1a8eaef111439feb71bda300a1d3
SHA256

96c7d1d5dab0c8060f3220816e3e49461ef328643d520545ffc8aa05ddd76760
SHA512

b01982718c3f62059f086c3274f9f8d1c98bbb9bcc187bfa466b369d08818cd2fe06e0949256eddbfd6f26b3fd5428ea8008d49adf6f233282f08c8dce4e9553
SSDEEP

24576:9sRgQPPLVkiouiRjaMkVRu9JS70cJscGh6U8mEGKacNpVAADNi5GeZTOjo:9sV3LGjpkVIJunw98mTKfVAyNioSTO

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FailedAssemblyInfo.vbs	Winsvc.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2476	Winsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2476	Winsvc.exe
Token: SeDebugPrivilege	2476	Winsvc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 4848	2476	Winsvc.exe	30
PID 2476 wrote to memory of 4848	2476	Winsvc.exe	30
PID 2476 wrote to memory of 4848	2476	Winsvc.exe	30

C:\Users\Admin\AppData\Local\Temp\Winsvc.exe
"C:\Users\Admin\AppData\Local\Temp\Winsvc.exe"
1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2476 -s 696
  2⤵
  PID:4848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2476-0-0x000007FEF5A73000-0x000007FEF5A74000-memory.dmp

Filesize
4KB

Download
memory/2476-1-0x0000000000370000-0x000000000050E000-memory.dmp

Filesize
1.6MB

Download
memory/2476-2-0x000000001C5F0000-0x000000001C790000-memory.dmp

Filesize
1.6MB

Download
memory/2476-3-0x000000001C5F0000-0x000000001C789000-memory.dmp

Filesize
1.6MB

Download
memory/2476-10-0x000000001C5F0000-0x000000001C789000-memory.dmp

Filesize
1.6MB

Download
memory/2476-28-0x000000001C5F0000-0x000000001C789000-memory.dmp

Filesize
1.6MB

Download
memory/2476-26-0x000000001C5F0000-0x000000001C789000-memory.dmp

Filesize
1.6MB

Download
memory/2476-22-0x000000001C5F0000-0x000000001C789000-memory.dmp

Filesize
1.6MB

Download
memory/2476-20-0x000000001C5F0000-0x000000001C789000-memory.dmp

Filesize
1.6MB

Download
memory/2476-19-0x000000001C5F0000-0x000000001C789000-memory.dmp

Filesize
1.6MB

Download
memory/2476-16-0x000000001C5F0000-0x000000001C789000-memory.dmp

Filesize
1.6MB

Download
memory/2476-14-0x000000001C5F0000-0x000000001C789000-memory.dmp

Filesize
1.6MB

Download
memory/2476-12-0x000000001C5F0000-0x000000001C789000-memory.dmp

Filesize
1.6MB

Download
memory/2476-8-0x000000001C5F0000-0x000000001C789000-memory.dmp

Filesize
1.6MB

Download
memory/2476-6-0x000000001C5F0000-0x000000001C789000-memory.dmp

Filesize
1.6MB

Download
memory/2476-36-0x000000001C5F0000-0x000000001C789000-memory.dmp

Filesize
1.6MB

Download
memory/2476-5-0x000000001C5F0000-0x000000001C789000-memory.dmp

Filesize
1.6MB

Download
memory/2476-24-0x000000001C5F0000-0x000000001C789000-memory.dmp

Filesize
1.6MB

Download
memory/2476-58-0x000000001C5F0000-0x000000001C789000-memory.dmp

Filesize
1.6MB

Download
memory/2476-66-0x000000001C5F0000-0x000000001C789000-memory.dmp

Filesize
1.6MB

Download
memory/2476-64-0x000000001C5F0000-0x000000001C789000-memory.dmp

Filesize
1.6MB

Download
memory/2476-62-0x000000001C5F0000-0x000000001C789000-memory.dmp

Filesize
1.6MB

Download
memory/2476-60-0x000000001C5F0000-0x000000001C789000-memory.dmp

Filesize
1.6MB

Download
memory/2476-56-0x000000001C5F0000-0x000000001C789000-memory.dmp

Filesize
1.6MB

Download
memory/2476-54-0x000000001C5F0000-0x000000001C789000-memory.dmp

Filesize
1.6MB

Download
memory/2476-52-0x000000001C5F0000-0x000000001C789000-memory.dmp

Filesize
1.6MB

Download
memory/2476-50-0x000000001C5F0000-0x000000001C789000-memory.dmp

Filesize
1.6MB

Download
memory/2476-48-0x000000001C5F0000-0x000000001C789000-memory.dmp

Filesize
1.6MB

Download
memory/2476-46-0x000000001C5F0000-0x000000001C789000-memory.dmp

Filesize
1.6MB

Download
memory/2476-44-0x000000001C5F0000-0x000000001C789000-memory.dmp

Filesize
1.6MB

Download
memory/2476-42-0x000000001C5F0000-0x000000001C789000-memory.dmp

Filesize
1.6MB

Download
memory/2476-40-0x000000001C5F0000-0x000000001C789000-memory.dmp

Filesize
1.6MB

Download
memory/2476-38-0x000000001C5F0000-0x000000001C789000-memory.dmp

Filesize
1.6MB

Download
memory/2476-34-0x000000001C5F0000-0x000000001C789000-memory.dmp

Filesize
1.6MB

Download
memory/2476-32-0x000000001C5F0000-0x000000001C789000-memory.dmp

Filesize
1.6MB

Download
memory/2476-30-0x000000001C5F0000-0x000000001C789000-memory.dmp

Filesize
1.6MB

Download
memory/2476-1153-0x000007FEF5A70000-0x000007FEF645C000-memory.dmp

Filesize
9.9MB

Download
memory/2476-1154-0x000007FEF5A73000-0x000007FEF5A74000-memory.dmp

Filesize
4KB

Download
memory/2476-1155-0x000000001BB70000-0x000000001BC7E000-memory.dmp

Filesize
1.1MB

Download
memory/2476-1156-0x0000000002510000-0x000000000255C000-memory.dmp

Filesize
304KB

Download
memory/2476-1157-0x000007FEF5A70000-0x000007FEF645C000-memory.dmp

Filesize
9.9MB

Download
memory/2476-1158-0x0000000002690000-0x00000000026E4000-memory.dmp

Filesize
336KB

Download
memory/2476-1161-0x000007FEF5A70000-0x000007FEF645C000-memory.dmp

Filesize
9.9MB

Download
memory/2476-1162-0x000007FEF5A70000-0x000007FEF645C000-memory.dmp

Filesize
9.9MB

Download