0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-01-2025 12:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
Size

1.5MB
MD5

3cd620c5bf4b29da743c85dcad495731
SHA1

69a90e801f0b11ebc37ca7e576fd9642acd49a10
SHA256

0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7
SHA512

0296f55d2a5a4c87ec05fe59a4c773e3c50c0da6e3112473caf1a13d1a371a82cde51b6883fdc7107035ef4465c422d5f38fb77360d43dd6bb5a8fc838d8835b
SSDEEP

24576:GpRl1R0dnN3Ctp20wJLh4918U6HdjwuLGdya3AWOENDSVXT5X1:GpRl1WStpwv4n8vcuyd1w4SXT5X1

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
Token: SeDebugPrivilege	2192	0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe

C:\Users\Admin\AppData\Local\Temp\0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe
"C:\Users\Admin\AppData\Local\Temp\0b17a7344626b52d99df2e463049bbd26f1eb9edbc602ef945ed3b2601fd5dd7.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2192-0-0x000007FEF5A13000-0x000007FEF5A14000-memory.dmp

Filesize
4KB

Download
memory/2192-1-0x0000000001C90000-0x0000000001CC4000-memory.dmp

Filesize
208KB

Download
memory/2192-2-0x000007FEF5A10000-0x000007FEF63FC000-memory.dmp

Filesize
9.9MB

Download
memory/2192-3-0x000007FEF5A10000-0x000007FEF63FC000-memory.dmp

Filesize
9.9MB

Download
memory/2192-4-0x000007FEF5A10000-0x000007FEF63FC000-memory.dmp

Filesize
9.9MB

Download
memory/2192-5-0x000007FEF5A10000-0x000007FEF63FC000-memory.dmp

Filesize
9.9MB

Download
memory/2192-6-0x0000000001CC0000-0x0000000001CCA000-memory.dmp

Filesize
40KB

Download
memory/2192-7-0x0000000001CC0000-0x0000000001CCA000-memory.dmp

Filesize
40KB

Download
memory/2192-8-0x000007FEF5A10000-0x000007FEF63FC000-memory.dmp

Filesize
9.9MB

Download
memory/2192-12-0x000007FEF5A10000-0x000007FEF63FC000-memory.dmp

Filesize
9.9MB

Download
memory/2192-35-0x000007FEF5A13000-0x000007FEF5A14000-memory.dmp

Filesize
4KB

Download
memory/2192-36-0x000007FEF5A10000-0x000007FEF63FC000-memory.dmp

Filesize
9.9MB

Download
memory/2192-37-0x000007FEF5A10000-0x000007FEF63FC000-memory.dmp

Filesize
9.9MB

Download
memory/2192-38-0x000007FEF5A10000-0x000007FEF63FC000-memory.dmp

Filesize
9.9MB

Download
memory/2192-39-0x0000000001CC0000-0x0000000001CCA000-memory.dmp

Filesize
40KB

Download
memory/2192-40-0x0000000001CC0000-0x0000000001CCA000-memory.dmp

Filesize
40KB

Download
memory/2192-41-0x000007FEF5A10000-0x000007FEF63FC000-memory.dmp

Filesize
9.9MB

Download
memory/2192-42-0x000007FEF5A10000-0x000007FEF63FC000-memory.dmp

Filesize
9.9MB

Download