b7aa6340c9ed8b1df2b916d5c1b4db354b133287a7b1b9ecd69e7121c942b9c6

Analysis

max time kernel
147s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 01:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b7aa6340c9ed8b1df2b916d5c1b4db354b133287a7b1b9ecd69e7121c942b9c6.exe
Size

432KB
MD5

f874fde4b1751554375043eccf69b156
SHA1

efa3bde56f6fe8627f4989b3ccfade1df914d4ca
SHA256

b7aa6340c9ed8b1df2b916d5c1b4db354b133287a7b1b9ecd69e7121c942b9c6
SHA512

6fc50b738216522a831784bf0af47a5776d85a396a095306436fe58c22af07f66d08bf520507d8fa82effbcc02fb5fc1f08f4284f639c18dedd387be509a7678
SSDEEP

6144:pP1pgHF5zHGX/yIPEReBIG/4aIP+1BUnqY0OfuGZMBzl32yH3S:pPEnjRIMkz4aIP+1BaqY70V2yX

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3204 set thread context of 504	3204	b7aa6340c9ed8b1df2b916d5c1b4db354b133287a7b1b9ecd69e7121c942b9c6.exe	82

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
504	b7aa6340c9ed8b1df2b916d5c1b4db354b133287a7b1b9ecd69e7121c942b9c6.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	504	b7aa6340c9ed8b1df2b916d5c1b4db354b133287a7b1b9ecd69e7121c942b9c6.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
504	b7aa6340c9ed8b1df2b916d5c1b4db354b133287a7b1b9ecd69e7121c942b9c6.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3204 wrote to memory of 504	3204	b7aa6340c9ed8b1df2b916d5c1b4db354b133287a7b1b9ecd69e7121c942b9c6.exe	82
PID 3204 wrote to memory of 504	3204	b7aa6340c9ed8b1df2b916d5c1b4db354b133287a7b1b9ecd69e7121c942b9c6.exe	82
PID 3204 wrote to memory of 504	3204	b7aa6340c9ed8b1df2b916d5c1b4db354b133287a7b1b9ecd69e7121c942b9c6.exe	82
PID 3204 wrote to memory of 504	3204	b7aa6340c9ed8b1df2b916d5c1b4db354b133287a7b1b9ecd69e7121c942b9c6.exe	82
PID 3204 wrote to memory of 504	3204	b7aa6340c9ed8b1df2b916d5c1b4db354b133287a7b1b9ecd69e7121c942b9c6.exe	82
PID 3204 wrote to memory of 504	3204	b7aa6340c9ed8b1df2b916d5c1b4db354b133287a7b1b9ecd69e7121c942b9c6.exe	82
PID 3204 wrote to memory of 504	3204	b7aa6340c9ed8b1df2b916d5c1b4db354b133287a7b1b9ecd69e7121c942b9c6.exe	82
PID 3204 wrote to memory of 504	3204	b7aa6340c9ed8b1df2b916d5c1b4db354b133287a7b1b9ecd69e7121c942b9c6.exe	82
PID 3204 wrote to memory of 504	3204	b7aa6340c9ed8b1df2b916d5c1b4db354b133287a7b1b9ecd69e7121c942b9c6.exe	82
PID 3204 wrote to memory of 504	3204	b7aa6340c9ed8b1df2b916d5c1b4db354b133287a7b1b9ecd69e7121c942b9c6.exe	82

C:\Users\Admin\AppData\Local\Temp\b7aa6340c9ed8b1df2b916d5c1b4db354b133287a7b1b9ecd69e7121c942b9c6.exe
"C:\Users\Admin\AppData\Local\Temp\b7aa6340c9ed8b1df2b916d5c1b4db354b133287a7b1b9ecd69e7121c942b9c6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Users\Admin\AppData\Local\Temp\b7aa6340c9ed8b1df2b916d5c1b4db354b133287a7b1b9ecd69e7121c942b9c6.exe
  "C:\Users\Admin\AppData\Local\Temp\b7aa6340c9ed8b1df2b916d5c1b4db354b133287a7b1b9ecd69e7121c942b9c6.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/504-144-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/504-143-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/504-135-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/504-139-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/504-141-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/504-140-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/504-160-0x0000000074E20000-0x00000000753D1000-memory.dmp

Filesize
5.7MB

Download
memory/504-137-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/504-146-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/504-159-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/504-157-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/504-142-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/504-147-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/504-149-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/504-151-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/504-152-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/504-154-0x0000000074E20000-0x00000000753D1000-memory.dmp

Filesize
5.7MB

Download
memory/504-156-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/3204-132-0x0000000074E20000-0x00000000753D1000-memory.dmp

Filesize
5.7MB

Download
memory/3204-133-0x0000000074E20000-0x00000000753D1000-memory.dmp

Filesize
5.7MB

Download
memory/3204-138-0x0000000074E20000-0x00000000753D1000-memory.dmp

Filesize
5.7MB

Download