Overview

overview

7

Static

static

E-Card_zu_...10.exe

windows7-x64

7

E-Card_zu_...10.exe

windows10-2004-x64

5

Analysis

  • max time kernel
    1s
  • max time network
    7s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-11-2022 16:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe

  • Size

    156KB

  • MD5

    8e9111802bf368404c2a18222b3eb986

  • SHA1

    6a744fd5cab051d4f115a172e45d7bcb9c14c276

  • SHA256

    2c4ca41292c07252bb043dae7697a91c140ba9be82fac5cd62c9f9c802959e0d

  • SHA512

    67a24d236ccf08b55a0f83338f11022da506ae9c89920162e2e6ab7a79545839f3fe118adaf4d5602ce452f9192e81d380364519beb040767b9d11ed05322832

  • SSDEEP

    3072:N2VpC7emUS2JQM2bPcmdeXTQ+LuV0/9HQZl3a12+sq:kVpC6mUVJ3IpY9x1vh

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3056
      • C:\Users\Admin\AppData\Local\Temp\E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe
        "C:\Users\Admin\AppData\Local\Temp\E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2680
        • C:\Users\Admin\AppData\Local\Temp\E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe
          C:\Users\Admin\AppData\Local\Temp\E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1208
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS6389~1.BAT"
            4⤵
              PID:2760

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1208-132-0x0000000000000000-mapping.dmp
        Download
      • memory/1208-133-0x0000000000400000-0x0000000000412000-memory.dmp
        Filesize

        72KB

        Download
      • memory/1208-136-0x0000000000400000-0x0000000000412000-memory.dmp
        Filesize

        72KB

        Download
      • memory/1208-139-0x0000000000400000-0x0000000000412000-memory.dmp
        Filesize

        72KB

        Download
      • memory/2680-135-0x00000000023F0000-0x00000000023F4000-memory.dmp
        Filesize

        16KB

        Download
      • memory/2760-137-0x0000000000000000-mapping.dmp
        Download
      • memory/3056-138-0x00007FFC25C10000-0x00007FFC25C20000-memory.dmp
        Filesize

        64KB

        Download