2a6cd5b04a1f823de82896e8d2758ce91498ee9231032ae946363477ccc7701a

Analysis

max time kernel
51s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/08/2022, 06:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Port Stewart - CTM at Belawan - ETA 1st Sep2022.exe
Size 974KB
Sample220830-hh292aech2
SHA256 2a6cd5b04a1f823de82896e8d2758ce91498ee9231032ae946363477ccc7701a
MD5 dfb525588536557d66ba787422e955c2
SHA1 c5a9b4d4b2aaac02418458f4ac40d005683b2090
SHA512 86d94a8f1dfe4d0b19f0dbab4d7c3106e56331f6ac4c9a7b3a723b57f40ad730cfff31368fb0b276241f6aed32632b5627f8dfe8b598d5777c54eedbeae0c00f
SSDEEP 12288:az0F75eW2xNQ7nHithtOH1Xoky66gqKGTB+iR0YL4ThA2E23uV+RqzB7Tq27fTkv:aIZ5NnritM14c89B+imYgE6Psb7BsX
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
892	Port Stewart - CTM at Belawan - ETA 1st Sep2022.exe
892	Port Stewart - CTM at Belawan - ETA 1st Sep2022.exe
892	Port Stewart - CTM at Belawan - ETA 1st Sep2022.exe
892	Port Stewart - CTM at Belawan - ETA 1st Sep2022.exe
892	Port Stewart - CTM at Belawan - ETA 1st Sep2022.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	892	Port Stewart - CTM at Belawan - ETA 1st Sep2022.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
892	Port Stewart - CTM at Belawan - ETA 1st Sep2022.exe
892	Port Stewart - CTM at Belawan - ETA 1st Sep2022.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 1680	892	Port Stewart - CTM at Belawan - ETA 1st Sep2022.exe	26
PID 892 wrote to memory of 1680	892	Port Stewart - CTM at Belawan - ETA 1st Sep2022.exe	26
PID 892 wrote to memory of 1680	892	Port Stewart - CTM at Belawan - ETA 1st Sep2022.exe	26
PID 892 wrote to memory of 1680	892	Port Stewart - CTM at Belawan - ETA 1st Sep2022.exe	26
PID 892 wrote to memory of 1544	892	Port Stewart - CTM at Belawan - ETA 1st Sep2022.exe	27
PID 892 wrote to memory of 1544	892	Port Stewart - CTM at Belawan - ETA 1st Sep2022.exe	27
PID 892 wrote to memory of 1544	892	Port Stewart - CTM at Belawan - ETA 1st Sep2022.exe	27
PID 892 wrote to memory of 1544	892	Port Stewart - CTM at Belawan - ETA 1st Sep2022.exe	27
PID 892 wrote to memory of 1924	892	Port Stewart - CTM at Belawan - ETA 1st Sep2022.exe	28
PID 892 wrote to memory of 1924	892	Port Stewart - CTM at Belawan - ETA 1st Sep2022.exe	28
PID 892 wrote to memory of 1924	892	Port Stewart - CTM at Belawan - ETA 1st Sep2022.exe	28
PID 892 wrote to memory of 1924	892	Port Stewart - CTM at Belawan - ETA 1st Sep2022.exe	28
PID 892 wrote to memory of 1844	892	Port Stewart - CTM at Belawan - ETA 1st Sep2022.exe	29
PID 892 wrote to memory of 1844	892	Port Stewart - CTM at Belawan - ETA 1st Sep2022.exe	29
PID 892 wrote to memory of 1844	892	Port Stewart - CTM at Belawan - ETA 1st Sep2022.exe	29
PID 892 wrote to memory of 1844	892	Port Stewart - CTM at Belawan - ETA 1st Sep2022.exe	29
PID 892 wrote to memory of 1588	892	Port Stewart - CTM at Belawan - ETA 1st Sep2022.exe	30
PID 892 wrote to memory of 1588	892	Port Stewart - CTM at Belawan - ETA 1st Sep2022.exe	30
PID 892 wrote to memory of 1588	892	Port Stewart - CTM at Belawan - ETA 1st Sep2022.exe	30
PID 892 wrote to memory of 1588	892	Port Stewart - CTM at Belawan - ETA 1st Sep2022.exe	30

C:\Users\Admin\AppData\Local\Temp\Port Stewart - CTM at Belawan - ETA 1st Sep2022.exe
"C:\Users\Admin\AppData\Local\Temp\Port Stewart - CTM at Belawan - ETA 1st Sep2022.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:892
- C:\Users\Admin\AppData\Local\Temp\Port Stewart - CTM at Belawan - ETA 1st Sep2022.exe
  "C:\Users\Admin\AppData\Local\Temp\Port Stewart - CTM at Belawan - ETA 1st Sep2022.exe"
  2⤵
  PID:1680
- C:\Users\Admin\AppData\Local\Temp\Port Stewart - CTM at Belawan - ETA 1st Sep2022.exe
  "C:\Users\Admin\AppData\Local\Temp\Port Stewart - CTM at Belawan - ETA 1st Sep2022.exe"
  2⤵
  PID:1544
- C:\Users\Admin\AppData\Local\Temp\Port Stewart - CTM at Belawan - ETA 1st Sep2022.exe
  "C:\Users\Admin\AppData\Local\Temp\Port Stewart - CTM at Belawan - ETA 1st Sep2022.exe"
  2⤵
  PID:1924
- C:\Users\Admin\AppData\Local\Temp\Port Stewart - CTM at Belawan - ETA 1st Sep2022.exe
  "C:\Users\Admin\AppData\Local\Temp\Port Stewart - CTM at Belawan - ETA 1st Sep2022.exe"
  2⤵
  PID:1844
- C:\Users\Admin\AppData\Local\Temp\Port Stewart - CTM at Belawan - ETA 1st Sep2022.exe
  "C:\Users\Admin\AppData\Local\Temp\Port Stewart - CTM at Belawan - ETA 1st Sep2022.exe"
  2⤵
  PID:1588

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/892-54-0x0000000000330000-0x000000000042A000-memory.dmp

Download

memory/892-55-0x0000000075451000-0x0000000075453000-memory.dmp

Download

memory/892-56-0x0000000000870000-0x0000000000888000-memory.dmp

Download

memory/892-57-0x00000000008D0000-0x00000000008DC000-memory.dmp

Download

memory/892-58-0x0000000005B20000-0x0000000005BF8000-memory.dmp

Download

memory/892-59-0x0000000005060000-0x00000000050E2000-memory.dmp

Download