Overview

overview

6

Static

static

3d07d2e657...54.exe

windows7-x64

5

3d07d2e657...54.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    152s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 14:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3d07d2e6578ff72a1b8a1edf8480d124a0e53eb56a5fddbc93d23e84dbb01654.exe

  • Size

    249KB

  • MD5

    e19ba675744a9df9efd521604c260fba

  • SHA1

    ead8f01c882f38ae10b6d4427229e8abe3ca0276

  • SHA256

    3d07d2e6578ff72a1b8a1edf8480d124a0e53eb56a5fddbc93d23e84dbb01654

  • SHA512

    0d0566f67aac770fefc7c17b569bee0a2567ad4ab041018f82bb288d7875d0bcafa85001f02835450d313618b2e49b4f53c8c3928e031b41edb658776c288086

  • SSDEEP

    6144:M9ZJP8+OZxKzYvJSu4R74kdGyLPkVjTqHD:cZt8+O6zYxSBR7n7LPkkH

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3d07d2e6578ff72a1b8a1edf8480d124a0e53eb56a5fddbc93d23e84dbb01654.exe
    "C:\Users\Admin\AppData\Local\Temp\3d07d2e6578ff72a1b8a1edf8480d124a0e53eb56a5fddbc93d23e84dbb01654.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1536
    • C:\Users\Admin\AppData\Local\Temp\3d07d2e6578ff72a1b8a1edf8480d124a0e53eb56a5fddbc93d23e84dbb01654.exe
      C:\Users\Admin\AppData\Local\Temp\3d07d2e6578ff72a1b8a1edf8480d124a0e53eb56a5fddbc93d23e84dbb01654.exe
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1000
      • C:\Users\Admin\AppData\Local\Temp\3d07d2e6578ff72a1b8a1edf8480d124a0e53eb56a5fddbc93d23e84dbb01654.exe
        C:\Users\Admin\AppData\Local\Temp\3d07d2e6578ff72a1b8a1edf8480d124a0e53eb56a5fddbc93d23e84dbb01654.exe
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1720
        • C:\Users\Admin\AppData\Local\Temp\3d07d2e6578ff72a1b8a1edf8480d124a0e53eb56a5fddbc93d23e84dbb01654.exe
          C:\Users\Admin\AppData\Local\Temp\3d07d2e6578ff72a1b8a1edf8480d124a0e53eb56a5fddbc93d23e84dbb01654.exe
          4⤵
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1796
          • C:\Users\Admin\AppData\Local\Temp\3d07d2e6578ff72a1b8a1edf8480d124a0e53eb56a5fddbc93d23e84dbb01654.exe
            C:\Users\Admin\AppData\Local\Temp\3d07d2e6578ff72a1b8a1edf8480d124a0e53eb56a5fddbc93d23e84dbb01654.exe
            5⤵
            • Suspicious use of SetThreadContext
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1496
            • C:\Users\Admin\AppData\Local\Temp\3d07d2e6578ff72a1b8a1edf8480d124a0e53eb56a5fddbc93d23e84dbb01654.exe
              C:\Users\Admin\AppData\Local\Temp\3d07d2e6578ff72a1b8a1edf8480d124a0e53eb56a5fddbc93d23e84dbb01654.exe
              6⤵
              • Suspicious use of SetThreadContext
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1208
              • C:\Users\Admin\AppData\Local\Temp\3d07d2e6578ff72a1b8a1edf8480d124a0e53eb56a5fddbc93d23e84dbb01654.exe
                C:\Users\Admin\AppData\Local\Temp\3d07d2e6578ff72a1b8a1edf8480d124a0e53eb56a5fddbc93d23e84dbb01654.exe
                7⤵
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1076
                • C:\Users\Admin\AppData\Local\Temp\3d07d2e6578ff72a1b8a1edf8480d124a0e53eb56a5fddbc93d23e84dbb01654.exe
                  C:\Users\Admin\AppData\Local\Temp\3d07d2e6578ff72a1b8a1edf8480d124a0e53eb56a5fddbc93d23e84dbb01654.exe
                  8⤵
                    PID:592

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/592-73-0x0000000000000000-mapping.dmp

      Download

    • memory/1000-55-0x0000000000000000-mapping.dmp

      Download

    • memory/1000-57-0x000007FEF2C70000-0x000007FEF3693000-memory.dmp

      Filesize

      10.1MB

      Download

    • memory/1000-59-0x0000000000BF6000-0x0000000000C15000-memory.dmp

      Filesize

      124KB

      Download

    • memory/1076-72-0x000007FEF4A30000-0x000007FEF5453000-memory.dmp

      Filesize

      10.1MB

      Download

    • memory/1076-70-0x0000000000000000-mapping.dmp

      Download

    • memory/1208-67-0x0000000000000000-mapping.dmp

      Download

    • memory/1208-71-0x0000000000C56000-0x0000000000C75000-memory.dmp

      Filesize

      124KB

      Download

    • memory/1208-68-0x000007FEF2C70000-0x000007FEF3693000-memory.dmp

      Filesize

      10.1MB

      Download

    • memory/1496-64-0x0000000000000000-mapping.dmp

      Download

    • memory/1496-66-0x000007FEF2C70000-0x000007FEF3693000-memory.dmp

      Filesize

      10.1MB

      Download

    • memory/1496-69-0x0000000000B36000-0x0000000000B55000-memory.dmp

      Filesize

      124KB

      Download

    • memory/1536-54-0x000007FEF4A30000-0x000007FEF5453000-memory.dmp

      Filesize

      10.1MB

      Download

    • memory/1536-56-0x0000000000B96000-0x0000000000BB5000-memory.dmp

      Filesize

      124KB

      Download

    • memory/1720-62-0x00000000002A6000-0x00000000002C5000-memory.dmp

      Filesize

      124KB

      Download

    • memory/1720-60-0x000007FEF4A30000-0x000007FEF5453000-memory.dmp

      Filesize

      10.1MB

      Download

    • memory/1720-58-0x0000000000000000-mapping.dmp

      Download

    • memory/1796-65-0x0000000000B26000-0x0000000000B45000-memory.dmp

      Filesize

      124KB

      Download

    • memory/1796-63-0x000007FEF4A30000-0x000007FEF5453000-memory.dmp

      Filesize

      10.1MB

      Download

    • memory/1796-61-0x0000000000000000-mapping.dmp

      Download