Analysis
-
max time kernel
44s -
max time network
79s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
26-11-2022 02:14
General
-
Target
RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe
-
Size
176KB
-
MD5
72fa9e74d45dda3085eafb77eb497b1a
-
SHA1
536b13842b5c0ff70177c0c4fd80ce1ff892a15e
-
SHA256
7a4e899fc05973c8d3fb596750fc1b848daad7cd2cc6cee2c8fb44977e39c45d
-
SHA512
f5313d65269010038072e25e2ca6859a914a5db31815ee662def861a7809f6098fd25dc68c142efd5e0929e420221393e73aa77fbcd4ba8af4da95a73329737c
-
SSDEEP
3072:zQnHNmI+yMkJR+Omz1C+cSQStd3jUQdW6OTHeOO16ogZrssN6wc+ga0Mhze:zwHBRtJ2BC+Cqz14TE6dZr5PQ
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe"C:\Users\Admin\AppData\Local\Temp\RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exeC:\Users\Admin\AppData\Local\Temp\RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS3003~1.BAT"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
16KB
-
-
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB