f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-12-2024 14:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe
Size

17KB
MD5

052b465678e55a597727235381e0a7de
SHA1

e81a1b6f7c41994265c891b61ca549dc1bd95d25
SHA256

f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a
SHA512

49e000b0775bb976153c25ae7dc42a24bc3f1e3158d4770af8bf0d4c6f564c8bccb966279ee296b5a3db8c791cd04219f3ad7c62f2825957f66df69a0e5b28cb
SSDEEP

384:kEGfInKqgn7PiAniAAAeXWLMN8GuTM0sg7UAmm6+5qZMXBNTV76fAw:kZfyU76AniAAAdJsCDXBNTpPw

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2612	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe
2612	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe
2612	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe
2612	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe
2612	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe
2612	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe
2612	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe
2612	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe
2612	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe
2612	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2612	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 2264	2612	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	31
PID 2612 wrote to memory of 2264	2612	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	31
PID 2612 wrote to memory of 2264	2612	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	31
PID 2612 wrote to memory of 2264	2612	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	31
PID 2612 wrote to memory of 2028	2612	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	32
PID 2612 wrote to memory of 2028	2612	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	32
PID 2612 wrote to memory of 2028	2612	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	32
PID 2612 wrote to memory of 2028	2612	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	32
PID 2612 wrote to memory of 1956	2612	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	33
PID 2612 wrote to memory of 1956	2612	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	33
PID 2612 wrote to memory of 1956	2612	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	33
PID 2612 wrote to memory of 1956	2612	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	33
PID 2612 wrote to memory of 3008	2612	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	34
PID 2612 wrote to memory of 3008	2612	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	34
PID 2612 wrote to memory of 3008	2612	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	34
PID 2612 wrote to memory of 3008	2612	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	34
PID 2612 wrote to memory of 3068	2612	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	35
PID 2612 wrote to memory of 3068	2612	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	35
PID 2612 wrote to memory of 3068	2612	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	35
PID 2612 wrote to memory of 3068	2612	f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe	35

C:\Users\Admin\AppData\Local\Temp\f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe
"C:\Users\Admin\AppData\Local\Temp\f3b264fddb4da99f002daa68859146f73cf1b1d55e98355b9f1c3a2254bda94a.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2264
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2028
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:1956
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:3008
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:3068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2612-0-0x000007FEF56A3000-0x000007FEF56A4000-memory.dmp

Filesize
4KB

Download
memory/2612-1-0x000000013FA70000-0x000000013FA78000-memory.dmp

Filesize
32KB

Download
memory/2612-2-0x000007FEF56A0000-0x000007FEF608C000-memory.dmp

Filesize
9.9MB

Download
memory/2612-3-0x000007FEF56A0000-0x000007FEF608C000-memory.dmp

Filesize
9.9MB

Download