a88f94d1c96b0224ac11dd7bcc922173877b9f6a9442b083c3fdca3d40dd1c65 | Triage

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7
submitted
23-10-2020 13:24

Sharing

Report Analysis Logs

General

Target

securefile.exe
Size

672KB
MD5

2840288c34a6fe8b9ff0dddc96c8f319
SHA1

603427314dd2c13f3ee19571f892675ce65843d5
SHA256

a88f94d1c96b0224ac11dd7bcc922173877b9f6a9442b083c3fdca3d40dd1c65
SHA512

ed463b6656176db4b51814f8be0b9ed6491c35b5714e5a122aa7d908f8a0b2f05ca5f7e29a36b8c473a0346cd85cdefcad60d6d866f709567e4387831d547af9

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

Processes:

securefile.exesecurefile.exe

description	pid	process	target process
PID 1036 set thread context of 1956	1036	securefile.exe	securefile.exe
PID 1956 set thread context of 2004	1956	securefile.exe	securefile.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

securefile.exesecurefile.exe

description pid process

Token: SeDebugPrivilege 1036 securefile.exe
Token: SeDebugPrivilege 1956 securefile.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

securefile.exesecurefile.exe

description	pid	process	target process
PID 1036 wrote to memory of 1956	1036	securefile.exe	securefile.exe
PID 1036 wrote to memory of 1956	1036	securefile.exe	securefile.exe
PID 1036 wrote to memory of 1956	1036	securefile.exe	securefile.exe
PID 1036 wrote to memory of 1956	1036	securefile.exe	securefile.exe
PID 1036 wrote to memory of 1956	1036	securefile.exe	securefile.exe
PID 1036 wrote to memory of 1956	1036	securefile.exe	securefile.exe
PID 1036 wrote to memory of 1956	1036	securefile.exe	securefile.exe
PID 1036 wrote to memory of 1956	1036	securefile.exe	securefile.exe
PID 1036 wrote to memory of 1956	1036	securefile.exe	securefile.exe
PID 1956 wrote to memory of 2004	1956	securefile.exe	securefile.exe
PID 1956 wrote to memory of 2004	1956	securefile.exe	securefile.exe
PID 1956 wrote to memory of 2004	1956	securefile.exe	securefile.exe
PID 1956 wrote to memory of 2004	1956	securefile.exe	securefile.exe
PID 1956 wrote to memory of 2004	1956	securefile.exe	securefile.exe
PID 1956 wrote to memory of 2004	1956	securefile.exe	securefile.exe
PID 1956 wrote to memory of 2004	1956	securefile.exe	securefile.exe
PID 1956 wrote to memory of 2004	1956	securefile.exe	securefile.exe
PID 1956 wrote to memory of 2004	1956	securefile.exe	securefile.exe
PID 1956 wrote to memory of 2004	1956	securefile.exe	securefile.exe

C:\Users\Admin\AppData\Local\Temp\securefile.exe
"C:\Users\Admin\AppData\Local\Temp\securefile.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1036

C:\Users\Admin\AppData\Local\Temp\securefile.exe
"C:\Users\Admin\AppData\Local\Temp\securefile.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1956

C:\Users\Admin\AppData\Local\Temp\securefile.exe
"C:\Users\Admin\AppData\Local\Temp\securefile.exe" /stext C:\ProgramData\Mails.txt
3⤵
PID:2004

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1956-1-0x000000000047840E-mapping.dmp

Download
memory/1956-0-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1956-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1956-3-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2004-5-0x0000000000411714-mapping.dmp

Download