Overview

overview

5

Static

static

a7429b66a5...d1.exe

windows7-x64

5

a7429b66a5...d1.exe

windows10-2004-x64

5

Analysis

  • max time kernel
    146s
  • max time network
    209s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-11-2022 04:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a7429b66a585a8dd1fb7c54897ed0136690223fff7627e415c311a53216753d1.exe

  • Size

    701KB

  • MD5

    b6024c18a3a6404dcefb967865f5295c

  • SHA1

    4107219530613a55e1351980426b9d096e77bc9f

  • SHA256

    a7429b66a585a8dd1fb7c54897ed0136690223fff7627e415c311a53216753d1

  • SHA512

    888425e433ab31d836af667b3a24ecdd7f27916e815d967491c665b88d28089ad728053f7980c45fb3fd23bdf6a52ed05655d22a12c310f6df1f6f8717287bea

  • SSDEEP

    12288:ec//////tDbUk+efLq+MFoOk7st9NZeftjbBF9QyFrT8xyENJBHHou8DViGH:ec//////tDbUse9k7st96fRZQyfENJB4

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 52 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a7429b66a585a8dd1fb7c54897ed0136690223fff7627e415c311a53216753d1.exe
    "C:\Users\Admin\AppData\Local\Temp\a7429b66a585a8dd1fb7c54897ed0136690223fff7627e415c311a53216753d1.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4560
    • C:\Users\Admin\AppData\Local\Temp\a7429b66a585a8dd1fb7c54897ed0136690223fff7627e415c311a53216753d1.exe
      C:\Users\Admin\AppData\Local\Temp\a7429b66a585a8dd1fb7c54897ed0136690223fff7627e415c311a53216753d1.exe
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/688-132-0x0000000000000000-mapping.dmp
    Download
  • memory/688-133-0x0000000000400000-0x00000000005A0000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/688-135-0x0000000000400000-0x00000000005A0000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/688-136-0x0000000000400000-0x00000000005A0000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/688-137-0x0000000000400000-0x00000000005A0000-memory.dmp
    Filesize

    1.6MB

    Download