0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-02-2025 19:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
Size

1.5MB
MD5

04f03fcf4b4ddf9555e00cc8c5b3f0cb
SHA1

f399b7187deb2c162ee6dfbf61c5a9afc410e646
SHA256

0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976
SHA512

c19deaf71c70a7518d1dbda5878dab0fae123eb2c9086cd7b6b2fa005fea52aa8662d23d731d27acfc30cb46a73c991fad60d9111ad97618f2b2fd6565ec68e3
SSDEEP

24576:n/PVLMJEjlYbFdn5dcIjKO/MT8d3hKvDSVXT5Xu/HaFyao:1MJ0YhN5LjKe53hKMXT5XuCF1o

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1972	0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe

C:\Users\Admin\AppData\Local\Temp\0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe
"C:\Users\Admin\AppData\Local\Temp\0f9178eaa084d32099c8aa0c9ba68fc89791f1d9f6ba90022557554558815976.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CabB6F2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
memory/1972-10-0x000007FEF6640000-0x000007FEF702C000-memory.dmp

Filesize
9.9MB

Download
memory/1972-6-0x000007FEF6640000-0x000007FEF702C000-memory.dmp

Filesize
9.9MB

Download
memory/1972-7-0x000007FEF6640000-0x000007FEF702C000-memory.dmp

Filesize
9.9MB

Download
memory/1972-9-0x0000000000270000-0x000000000027A000-memory.dmp

Filesize
40KB

Download
memory/1972-8-0x0000000000270000-0x000000000027A000-memory.dmp

Filesize
40KB

Download
memory/1972-0-0x000007FEF6643000-0x000007FEF6644000-memory.dmp

Filesize
4KB

Download
memory/1972-3-0x0000000001E70000-0x0000000001EA2000-memory.dmp

Filesize
200KB

Download
memory/1972-43-0x000007FEF6643000-0x000007FEF6644000-memory.dmp

Filesize
4KB

Download
memory/1972-44-0x000007FEF6640000-0x000007FEF702C000-memory.dmp

Filesize
9.9MB

Download
memory/1972-45-0x0000000000270000-0x000000000027A000-memory.dmp

Filesize
40KB

Download
memory/1972-46-0x0000000000270000-0x000000000027A000-memory.dmp

Filesize
40KB

Download
memory/1972-47-0x000007FEF6640000-0x000007FEF702C000-memory.dmp

Filesize
9.9MB

Download