996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1

Analysis

max time kernel
150s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/02/2025, 08:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
Size

1.2MB
MD5

d55a42b226fb7fbd9bb74fa04bf341d5
SHA1

fd1142ab5e87027ab39753bfcbc213d9363ff2ec
SHA256

996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1
SHA512

7155be455c891a8ee4afb22872536245ae841de8e0a2c88e905c103814961a416f0b843fbe2741d823b47d48b1aa83fe6b970132da8cac2d55c17f7587fa9d86
SSDEEP

24576:kibuXQfYImWqv8DzOPV8x+3PRfF5oqbJ7EDS06r:kkoQAIqkDi++/ZV7R

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2932	996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe

C:\Users\Admin\AppData\Local\Temp\996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe
"C:\Users\Admin\AppData\Local\Temp\996610ab6049ff0cd08f5884728a3e145e7532ed5a77f8f17614aeb3e374b9e1.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2932-0-0x000007FEF5D53000-0x000007FEF5D54000-memory.dmp

Filesize
4KB

Download
memory/2932-1-0x0000000000380000-0x00000000003B2000-memory.dmp

Filesize
200KB

Download
memory/2932-2-0x000007FEF5D50000-0x000007FEF673C000-memory.dmp

Filesize
9.9MB

Download
memory/2932-3-0x000007FEF5D50000-0x000007FEF673C000-memory.dmp

Filesize
9.9MB

Download
memory/2932-4-0x000007FEF5D50000-0x000007FEF673C000-memory.dmp

Filesize
9.9MB

Download
memory/2932-7-0x000007FEF5D50000-0x000007FEF673C000-memory.dmp

Filesize
9.9MB

Download
memory/2932-9-0x000007FEF5D50000-0x000007FEF673C000-memory.dmp

Filesize
9.9MB

Download
memory/2932-10-0x000007FEF5D50000-0x000007FEF673C000-memory.dmp

Filesize
9.9MB

Download
memory/2932-11-0x000007FEF5D53000-0x000007FEF5D54000-memory.dmp

Filesize
4KB

Download
memory/2932-12-0x000007FEF5D50000-0x000007FEF673C000-memory.dmp

Filesize
9.9MB

Download
memory/2932-28-0x000007FEF5D50000-0x000007FEF673C000-memory.dmp

Filesize
9.9MB

Download
memory/2932-29-0x000007FEF5D50000-0x000007FEF673C000-memory.dmp

Filesize
9.9MB

Download
memory/2932-30-0x000007FEF5D50000-0x000007FEF673C000-memory.dmp

Filesize
9.9MB

Download
memory/2932-31-0x000007FEF5D50000-0x000007FEF673C000-memory.dmp

Filesize
9.9MB

Download
memory/2932-32-0x000007FEF5D50000-0x000007FEF673C000-memory.dmp

Filesize
9.9MB

Download
memory/2932-33-0x000007FEF5D50000-0x000007FEF673C000-memory.dmp

Filesize
9.9MB

Download