504aba9ffc85b963c92b2725c54b2f16e8dca913b5dbe2b7d75786eee3692a38

Analysis

max time kernel
147s
max time network
192s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 09:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

©ɱ/040.exe
Size

135KB
MD5

4fe84fc378421449ce4796ae6662aa50
SHA1

7e5522d49418c237e1c06f6794875fa32a1fa3c7
SHA256

439f331f1193005bab42f18faed822b2b9345762a7a81ca501063d6e655ccae2
SHA512

4aa1337443548533e45e6d92d2b3d1e55bf263eb5c0854623a91602fca561a5303ff62d8905cff86ae02920f16ebef827e8fae0ab9e1c799acd0757482fa5895
SSDEEP

1536:4/yPJze2vZcTmW44YM6HsYYpQjXscm+ZNfycqNOMPCHSHuQH9ORVsvdj17dlK+Gq:4/YxeHTmucYgcdyxUIMPCcH9K6jHlKZE

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

040.exe

description pid process target process

PID 940 set thread context of 1140 940 040.exe 040.exe
Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

040.exe040.exe

pid process

940 040.exe
1140 040.exe
1140 040.exe
1140 040.exe
1140 040.exe
1140 040.exe
1140 040.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

1284
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

040.exe

pid process

1140 040.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

description pid process

Token: SeShutdownPrivilege 1284
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

040.exe

pid process

940 040.exe
940 040.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

1284

description	pid	process	target process
PID 940 set thread context of 1140	940	040.exe	040.exe

pid	process
940	040.exe
1140	040.exe
1140	040.exe
1140	040.exe
1140	040.exe
1140	040.exe
1140	040.exe

pid	process
1284

pid	process
1140	040.exe

description	pid	process
Token: SeShutdownPrivilege	1284

pid	process
940	040.exe
940	040.exe

pid	process
1284

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

040.exe040.exe

description	pid	process	target process
PID 940 wrote to memory of 1140	940	040.exe	040.exe
PID 940 wrote to memory of 1140	940	040.exe	040.exe
PID 940 wrote to memory of 1140	940	040.exe	040.exe
PID 940 wrote to memory of 1140	940	040.exe	040.exe
PID 940 wrote to memory of 1140	940	040.exe	040.exe
PID 940 wrote to memory of 1140	940	040.exe	040.exe
PID 940 wrote to memory of 1140	940	040.exe	040.exe
PID 940 wrote to memory of 1140	940	040.exe	040.exe
PID 940 wrote to memory of 1140	940	040.exe	040.exe
PID 1140 wrote to memory of 1484	1140	040.exe	cmd.exe
PID 1140 wrote to memory of 1484	1140	040.exe	cmd.exe
PID 1140 wrote to memory of 1484	1140	040.exe	cmd.exe
PID 1140 wrote to memory of 1484	1140	040.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\©ɱ\040.exe
"C:\Users\Admin\AppData\Local\Temp\©ɱ\040.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:940

C:\Users\Admin\AppData\Local\Temp\©ɱ\040.exe
C:\Users\Admin\AppData\Local\Temp\©ɱ\040.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1140

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpf07d70b5.bat"
3⤵
PID:1484

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpf07d70b5.bat
Filesize
199B

MD5
a678248ebcea67e4f47524d35a3a48df

SHA1
fdf0ef354b7beca51ec1d0c5c6eedc98c24e4450

SHA256
aa9baf0858086ae2d6f602f12fb17ffe224c7476545443bc71a6fe6166b3c6af

SHA512
89b6ba07d5a6867791c5a10373485fabfb8029e7d11acf6d651a6797ecd093452992c90bc5b0f960167a8b4be5dbc31f6809c0981f307c49dd2afbef682a7bc3

Download Submit
memory/940-58-0x0000000000310000-0x0000000000314000-memory.dmp

Filesize
16KB

Download
memory/940-54-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download
memory/1140-66-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1140-59-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1140-60-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1140-62-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1140-63-0x0000000000418001-mapping.dmp

Download
memory/1140-56-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1140-67-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1140-68-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1140-69-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1140-72-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1140-55-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1284-70-0x00000000029A0000-0x00000000029AD000-memory.dmp

Filesize
52KB

Download
memory/1484-71-0x0000000000000000-mapping.dmp

Download