91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
11-12-2024 14:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe
Size

16KB
MD5

bf7fe6eb5bb1370037fb32f2ca3af19d
SHA1

e84b45ef4672259fa6ba963c1d49683343c4e1dd
SHA256

91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755
SHA512

0ac27873c53bbac3e3b108b282f848a61638c17ec3ca4effa9e477e19a48661bb79671f87ab28cb7fcb5595e4908cde4362711f7487abffca483f0799524e33f
SSDEEP

384:rEfOryV5/k95TsZmLMN8GuTs0sg7UVOmhXpTV7qfOA:rFCA4gtsBhXpTpBA

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2064	91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe
2064	91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe
2064	91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe
2064	91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe
2064	91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe
2064	91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe
2064	91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe
2064	91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2064	91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 1996	2064	91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe	30
PID 2064 wrote to memory of 1996	2064	91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe	30
PID 2064 wrote to memory of 1996	2064	91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe	30
PID 2064 wrote to memory of 1996	2064	91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe	30
PID 2064 wrote to memory of 2640	2064	91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe	31
PID 2064 wrote to memory of 2640	2064	91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe	31
PID 2064 wrote to memory of 2640	2064	91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe	31
PID 2064 wrote to memory of 2640	2064	91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe	31
PID 2064 wrote to memory of 2360	2064	91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe	32
PID 2064 wrote to memory of 2360	2064	91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe	32
PID 2064 wrote to memory of 2360	2064	91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe	32
PID 2064 wrote to memory of 2360	2064	91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe	32
PID 2064 wrote to memory of 2592	2064	91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe	33
PID 2064 wrote to memory of 2592	2064	91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe	33
PID 2064 wrote to memory of 2592	2064	91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe	33
PID 2064 wrote to memory of 2592	2064	91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe	33

C:\Users\Admin\AppData\Local\Temp\91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe
"C:\Users\Admin\AppData\Local\Temp\91542661ee655caabae948eb3a7e9a2a96ea3bbb389735db9c860d33d1390755.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:1996
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2640
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2360
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2592

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2064-0-0x000007FEF5EC3000-0x000007FEF5EC4000-memory.dmp

Filesize
4KB

Download
memory/2064-1-0x000000013F880000-0x000000013F888000-memory.dmp

Filesize
32KB

Download
memory/2064-2-0x000007FEF5EC0000-0x000007FEF68AC000-memory.dmp

Filesize
9.9MB

Download
memory/2064-3-0x000007FEF5EC0000-0x000007FEF68AC000-memory.dmp

Filesize
9.9MB

Download