91d45d4558b4f934e758ab759f27abaa8f98c1b346fca94032a4fc86bfad2974

Analysis

max time kernel
103s
max time network
112s
platform
windows10_x64
resource
win10v20201028
submitted
09/02/2021, 15:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CAF Group Order 0045219001.exe
Size 684KB
Sample210209-dk95pbqvtx
SHA256 91d45d4558b4f934e758ab759f27abaa8f98c1b346fca94032a4fc86bfad2974
MD5 4f1a75317d67f8772bd93eae3405de11
SHA1 97c6f6c5c24ea083f0a7c28d70ca14a50b9c9d0e
SHA512 f29ed8809872ab05c76930966f64b747a7b142fcf3cf6ce364871046b21c1cb9c7535a962b6f2d92d80011f729a49f70f56dee8aba7c60d21793bd0e7e121c07
MD5 SHA1 SHA512

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 880 set thread context of 3612	880	CAF Group Order 0045219001.exe	80

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
880	CAF Group Order 0045219001.exe
880	CAF Group Order 0045219001.exe
3612	CAF Group Order 0045219001.exe
3612	CAF Group Order 0045219001.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	880	CAF Group Order 0045219001.exe
Token: SeDebugPrivilege	3612	CAF Group Order 0045219001.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 3448	880	CAF Group Order 0045219001.exe	79
PID 880 wrote to memory of 3448	880	CAF Group Order 0045219001.exe	79
PID 880 wrote to memory of 3448	880	CAF Group Order 0045219001.exe	79
PID 880 wrote to memory of 3612	880	CAF Group Order 0045219001.exe	80
PID 880 wrote to memory of 3612	880	CAF Group Order 0045219001.exe	80
PID 880 wrote to memory of 3612	880	CAF Group Order 0045219001.exe	80
PID 880 wrote to memory of 3612	880	CAF Group Order 0045219001.exe	80
PID 880 wrote to memory of 3612	880	CAF Group Order 0045219001.exe	80
PID 880 wrote to memory of 3612	880	CAF Group Order 0045219001.exe	80
PID 880 wrote to memory of 3612	880	CAF Group Order 0045219001.exe	80
PID 880 wrote to memory of 3612	880	CAF Group Order 0045219001.exe	80

C:\Users\Admin\AppData\Local\Temp\CAF Group Order 0045219001.exe
"C:\Users\Admin\AppData\Local\Temp\CAF Group Order 0045219001.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:880
- C:\Users\Admin\AppData\Local\Temp\CAF Group Order 0045219001.exe
  "C:\Users\Admin\AppData\Local\Temp\CAF Group Order 0045219001.exe"
  2⤵
  PID:3448
- C:\Users\Admin\AppData\Local\Temp\CAF Group Order 0045219001.exe
  "C:\Users\Admin\AppData\Local\Temp\CAF Group Order 0045219001.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/880-7-0x0000000004A90000-0x0000000004A91000-memory.dmp

Download

memory/880-3-0x0000000000040000-0x0000000000041000-memory.dmp

Download

memory/880-6-0x0000000004EF0000-0x0000000004EF1000-memory.dmp

Download

memory/880-2-0x0000000073460000-0x0000000073B4E000-memory.dmp

Download

memory/880-8-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

Download

memory/880-9-0x0000000004900000-0x0000000004901000-memory.dmp

Download

memory/880-5-0x0000000004950000-0x0000000004951000-memory.dmp

Download

memory/880-10-0x0000000004C00000-0x0000000004C01000-memory.dmp

Download

memory/880-12-0x00000000009D0000-0x0000000000A36000-memory.dmp

Download

memory/880-11-0x0000000004CD0000-0x0000000004CD4000-memory.dmp

Download

memory/3612-13-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3612-16-0x0000000073460000-0x0000000073B4E000-memory.dmp

Download

memory/3612-21-0x0000000005790000-0x0000000005791000-memory.dmp

Download

memory/3612-22-0x00000000058E0000-0x00000000058E1000-memory.dmp

Download

memory/3612-23-0x0000000006420000-0x0000000006421000-memory.dmp

Download