46dc49be65d7165e2a6009854a4f27f0088230199e61e0555cb1bd266535874a

Analysis

max time kernel
121s
max time network
138s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 17:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

foo/0044d66e4abf7c4af6b5d207065320f7.exe
Size

127KB
MD5

0044d66e4abf7c4af6b5d207065320f7
SHA1

07e73ac58bee7bdc26d289bb2697d2588a6b7e64
SHA256

b6d19c3e6e82bbde62984f50144ce4d98a18871374ec5d313489d5831317c480
SHA512

25633ea2e3cc78262ba69de30d2d3b7f6c013ce3bcbad2eda3c424ac50d7c0b7169372c5ad2b2cd81748ea0622f3db5ba3429f0d3ecfd3feabbfc65d961af5dd
SSDEEP

3072:Z81clNypY+TjMulQXTR5aJPh7w/1VOCINO2L2Sy7CU9/7NXeLKo1tjv:ZAclNyW+PtqR5M7o1VP+2R7CU9DNXemu

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2304	0044d66e4abf7c4af6b5d207065320f7.exe
2304	0044d66e4abf7c4af6b5d207065320f7.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeDebugPrivilege	2304	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	2304	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	2304	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	2304	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	2304	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	2304	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	2304	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	2304	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	2304	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	2304	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	2304	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	2304	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	2304	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	2304	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	2304	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	2304	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	2304	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	2304	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	2304	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	2304	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	2304	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	2304	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	2304	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	2304	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	2304	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	2304	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	2304	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	2304	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	2304	0044d66e4abf7c4af6b5d207065320f7.exe
Token: SeDebugPrivilege	2304	0044d66e4abf7c4af6b5d207065320f7.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 1388	2304	0044d66e4abf7c4af6b5d207065320f7.exe	21
PID 2304 wrote to memory of 256	2304	0044d66e4abf7c4af6b5d207065320f7.exe	1
PID 2304 wrote to memory of 332	2304	0044d66e4abf7c4af6b5d207065320f7.exe	2
PID 2304 wrote to memory of 372	2304	0044d66e4abf7c4af6b5d207065320f7.exe	3
PID 2304 wrote to memory of 380	2304	0044d66e4abf7c4af6b5d207065320f7.exe	4
PID 2304 wrote to memory of 420	2304	0044d66e4abf7c4af6b5d207065320f7.exe	5
PID 2304 wrote to memory of 464	2304	0044d66e4abf7c4af6b5d207065320f7.exe	6
PID 2304 wrote to memory of 480	2304	0044d66e4abf7c4af6b5d207065320f7.exe	7
PID 2304 wrote to memory of 488	2304	0044d66e4abf7c4af6b5d207065320f7.exe	8
PID 2304 wrote to memory of 584	2304	0044d66e4abf7c4af6b5d207065320f7.exe	9
PID 2304 wrote to memory of 664	2304	0044d66e4abf7c4af6b5d207065320f7.exe	10
PID 2304 wrote to memory of 748	2304	0044d66e4abf7c4af6b5d207065320f7.exe	11
PID 2304 wrote to memory of 808	2304	0044d66e4abf7c4af6b5d207065320f7.exe	12
PID 2304 wrote to memory of 844	2304	0044d66e4abf7c4af6b5d207065320f7.exe	13
PID 2304 wrote to memory of 988	2304	0044d66e4abf7c4af6b5d207065320f7.exe	15
PID 2304 wrote to memory of 296	2304	0044d66e4abf7c4af6b5d207065320f7.exe	16
PID 2304 wrote to memory of 108	2304	0044d66e4abf7c4af6b5d207065320f7.exe	17
PID 2304 wrote to memory of 532	2304	0044d66e4abf7c4af6b5d207065320f7.exe	18
PID 2304 wrote to memory of 1240	2304	0044d66e4abf7c4af6b5d207065320f7.exe	19
PID 2304 wrote to memory of 1324	2304	0044d66e4abf7c4af6b5d207065320f7.exe	20
PID 2304 wrote to memory of 1388	2304	0044d66e4abf7c4af6b5d207065320f7.exe	21
PID 2304 wrote to memory of 1676	2304	0044d66e4abf7c4af6b5d207065320f7.exe	23
PID 2304 wrote to memory of 1088	2304	0044d66e4abf7c4af6b5d207065320f7.exe	24
PID 2304 wrote to memory of 1652	2304	0044d66e4abf7c4af6b5d207065320f7.exe	25
PID 2304 wrote to memory of 2460	2304	0044d66e4abf7c4af6b5d207065320f7.exe	26
PID 2304 wrote to memory of 2160	2304	0044d66e4abf7c4af6b5d207065320f7.exe	27
PID 2304 wrote to memory of 1344	2304	0044d66e4abf7c4af6b5d207065320f7.exe	28

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:256

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:332

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:372
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:464
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:584
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:1676
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe
      4⤵
      PID:1652
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:664
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:748
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:808
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1324
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:844
  - - \\?\C:\Windows\system32\wbem\WMIADAP.EXE
      wmiadap.exe /F /T /R
      4⤵
      PID:1344
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:988
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:296
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:108
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:532
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1240
- - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    3⤵
    PID:1088
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:2460
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:2160
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:480
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:488

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:380

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1388
- C:\Users\Admin\AppData\Local\Temp\foo\0044d66e4abf7c4af6b5d207065320f7.exe
  "C:\Users\Admin\AppData\Local\Temp\foo\0044d66e4abf7c4af6b5d207065320f7.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1388-3-0x0000000002640000-0x000000000264C000-memory.dmp

Filesize
48KB

Download
memory/2304-1-0x0000000000220000-0x000000000022A000-memory.dmp

Filesize
40KB

Download
memory/2304-2-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2304-0-0x0000000000220000-0x000000000022A000-memory.dmp

Filesize
40KB

Download
memory/2304-37-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2304-36-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download