f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
11-12-2024 14:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe
Size

17KB
MD5

052b465678e55a597727235381e0a7de
SHA1

e81a1b6f7c41994265c891b61ca549dc1bd95d25
SHA256

f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a
SHA512

49e000b0775bb976153c25ae7dc42a24bc3f1e3158d4770af8bf0d4c6f564c8bccb966279ee296b5a3db8c791cd04219f3ad7c62f2825957f66df69a0e5b28cb
SSDEEP

384:kEGfInKqgn7PiAniAAAeXWLMN8GuTM0sg7UAmm6+5qZMXBNTV76fAw:kZfyU76AniAAAdJsCDXBNTpPw

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2272	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe
2272	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe
2272	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe
2272	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe
2272	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe
2272	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe
2272	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe
2272	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe
2272	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe
2272	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe
2272	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe
2272	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe
2272	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe
2272	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2272	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2320	2272	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	30
PID 2272 wrote to memory of 2320	2272	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	30
PID 2272 wrote to memory of 2320	2272	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	30
PID 2272 wrote to memory of 2320	2272	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	30
PID 2272 wrote to memory of 2532	2272	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	31
PID 2272 wrote to memory of 2532	2272	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	31
PID 2272 wrote to memory of 2532	2272	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	31
PID 2272 wrote to memory of 2532	2272	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	31
PID 2272 wrote to memory of 1532	2272	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	32
PID 2272 wrote to memory of 1532	2272	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	32
PID 2272 wrote to memory of 1532	2272	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	32
PID 2272 wrote to memory of 1532	2272	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	32
PID 2272 wrote to memory of 3036	2272	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	33
PID 2272 wrote to memory of 3036	2272	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	33
PID 2272 wrote to memory of 3036	2272	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	33
PID 2272 wrote to memory of 3036	2272	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	33
PID 2272 wrote to memory of 2852	2272	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	34
PID 2272 wrote to memory of 2852	2272	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	34
PID 2272 wrote to memory of 2852	2272	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	34
PID 2272 wrote to memory of 2852	2272	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	34
PID 2272 wrote to memory of 2484	2272	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	35
PID 2272 wrote to memory of 2484	2272	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	35
PID 2272 wrote to memory of 2484	2272	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	35
PID 2272 wrote to memory of 2484	2272	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	35
PID 2272 wrote to memory of 1404	2272	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	36
PID 2272 wrote to memory of 1404	2272	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	36
PID 2272 wrote to memory of 1404	2272	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	36
PID 2272 wrote to memory of 1404	2272	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	36

C:\Users\Admin\AppData\Local\Temp\f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe
"C:\Users\Admin\AppData\Local\Temp\f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2320
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2532
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:1532
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:3036
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2852
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2484
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:1404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2272-0-0x000007FEF6103000-0x000007FEF6104000-memory.dmp

Filesize
4KB

Download
memory/2272-1-0x000000013F690000-0x000000013F698000-memory.dmp

Filesize
32KB

Download
memory/2272-2-0x000007FEF6100000-0x000007FEF6AEC000-memory.dmp

Filesize
9.9MB

Download
memory/2272-3-0x000007FEF6100000-0x000007FEF6AEC000-memory.dmp

Filesize
9.9MB

Download