484964bea7a57fe5c2caa7afe5efc6e298aec909c24c2b6fcc093604f7cd2206

Analysis

max time kernel
64s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 04:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

484964bea7a57fe5c2caa7afe5efc6e298aec909c24c2b6fcc093604f7cd2206.exe
Size

44KB
MD5

048a8d81598768ffd46e09546e2e3d26
SHA1

42d441c629052523e457e70e689931aec139a4a2
SHA256

484964bea7a57fe5c2caa7afe5efc6e298aec909c24c2b6fcc093604f7cd2206
SHA512

239f4ee3df1fade8b35dd361bef1dca889ef4735c1834251d313ef4b87e17be0f607dc88de8a0cbd9bd224003be8f368d200339901d0202e4749207691f178bf
SSDEEP

768:0OBkAxo+6syx2MycJok476+foYxw/e0qkk63pSgmo065Lws+1o/Ffw0m8cdiZrk:H1xR6sxM/JoLfzU7qk73cN6uo9o0m1sA

Score

6^/10

Malware Config

Signatures

Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery

T1063

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Eset\Nod\CurrentVersion\Modules\Update\Settings	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1104 set thread context of 1124	1104	484964bea7a57fe5c2caa7afe5efc6e298aec909c24c2b6fcc093604f7cd2206.exe	27

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 1124	1104	484964bea7a57fe5c2caa7afe5efc6e298aec909c24c2b6fcc093604f7cd2206.exe	27
PID 1104 wrote to memory of 1124	1104	484964bea7a57fe5c2caa7afe5efc6e298aec909c24c2b6fcc093604f7cd2206.exe	27
PID 1104 wrote to memory of 1124	1104	484964bea7a57fe5c2caa7afe5efc6e298aec909c24c2b6fcc093604f7cd2206.exe	27
PID 1104 wrote to memory of 1124	1104	484964bea7a57fe5c2caa7afe5efc6e298aec909c24c2b6fcc093604f7cd2206.exe	27
PID 1104 wrote to memory of 1124	1104	484964bea7a57fe5c2caa7afe5efc6e298aec909c24c2b6fcc093604f7cd2206.exe	27

C:\Users\Admin\AppData\Local\Temp\484964bea7a57fe5c2caa7afe5efc6e298aec909c24c2b6fcc093604f7cd2206.exe
"C:\Users\Admin\AppData\Local\Temp\484964bea7a57fe5c2caa7afe5efc6e298aec909c24c2b6fcc093604f7cd2206.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Checks for any installed AV software in registry
  PID:1124

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Security Software Discovery

T1063

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1124-54-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1124-57-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1124-58-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1124-59-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download