fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695

Analysis

max time kernel
149s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-02-2025 01:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
Size

2.0MB
MD5

05f416a76dc0e7c1afe86c2613c29d78
SHA1

624e8eb350261067443adf49817c5a72b7f9d80d
SHA256

fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695
SHA512

3b5aa3a9580cbff264f7e04e7207948e08fa46d62fa3425a50ade91772e3d60ca2096adc5f091f09aed14d1a855ac221f271a22c3795447fc8711a816642c7ce
SSDEEP

49152:AVImnP3ObryxvZcaS39o1LsWO4iaXT5XeM1L:A8OOaS36D5r1L

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
Token: SeDebugPrivilege	2800	fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe

C:\Users\Admin\AppData\Local\Temp\fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe
"C:\Users\Admin\AppData\Local\Temp\fcf89751a780aae3a97bc528a07e8017a74554b0eb0255ea0a4a026b3becb695.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2800-0-0x000007FEF53F3000-0x000007FEF53F4000-memory.dmp

Filesize
4KB

Download
memory/2800-1-0x0000000000170000-0x00000000001A4000-memory.dmp

Filesize
208KB

Download
memory/2800-2-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

Filesize
9.9MB

Download
memory/2800-3-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

Filesize
9.9MB

Download
memory/2800-4-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

Filesize
9.9MB

Download
memory/2800-5-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

Filesize
9.9MB

Download
memory/2800-8-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

Filesize
9.9MB

Download
memory/2800-7-0x0000000000420000-0x000000000042A000-memory.dmp

Filesize
40KB

Download
memory/2800-6-0x0000000000420000-0x000000000042A000-memory.dmp

Filesize
40KB

Download
memory/2800-12-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

Filesize
9.9MB

Download
memory/2800-31-0x000007FEF53F3000-0x000007FEF53F4000-memory.dmp

Filesize
4KB

Download
memory/2800-32-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

Filesize
9.9MB

Download
memory/2800-33-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

Filesize
9.9MB

Download
memory/2800-34-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

Filesize
9.9MB

Download
memory/2800-35-0x0000000000420000-0x000000000042A000-memory.dmp

Filesize
40KB

Download
memory/2800-36-0x0000000000420000-0x000000000042A000-memory.dmp

Filesize
40KB

Download
memory/2800-37-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

Filesize
9.9MB

Download
memory/2800-38-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

Filesize
9.9MB

Download