13718f5b41c60a63166bf48a0cf937f794d0974624d9c4f51304683dc56be301

Analysis

max time kernel
3s
max time network
5s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 18:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe
Size

156KB
MD5

2dec40d7b7933f41203fc40ff5f9f6a2
SHA1

e9bf4aa0dfd58f51fb49553e6c0ac7e305039c7e
SHA256

27c298c77e16bbc3f056653034c2d918418f877bb0193a9ca533b5527d830a94
SHA512

6c04dd52b99ff919797ff1851aaa45f3953643157f4d522b4b11336ec7d49a105e2274175a6932f4acefd1dcba4b8f4864d9eec71da8ab317ad937d2d2354322
SSDEEP

3072:m2V3A7emadat92PH48GLnCo0dXjxTsuGb+j3FRvtVFVlD2Pq:xV3A6mkat98LdzxwuGWJ7V1D

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4808 set thread context of 2872	4808	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe	79

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4808	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe
4808	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe
2872	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe
2872	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2872	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4808	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe
4808	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 2872	4808	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe	79
PID 4808 wrote to memory of 2872	4808	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe	79
PID 4808 wrote to memory of 2872	4808	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe	79
PID 4808 wrote to memory of 2872	4808	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe	79
PID 4808 wrote to memory of 2872	4808	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe	79
PID 4808 wrote to memory of 2872	4808	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe	79
PID 4808 wrote to memory of 2872	4808	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe	79
PID 4808 wrote to memory of 2872	4808	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe	79
PID 4808 wrote to memory of 2872	4808	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe	79
PID 2872 wrote to memory of 2124	2872	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe	80
PID 2872 wrote to memory of 2124	2872	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe	80
PID 2872 wrote to memory of 2124	2872	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe	80
PID 2872 wrote to memory of 1272	2872	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe	38

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1272
- C:\Users\Admin\AppData\Local\Temp\E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe
  "C:\Users\Admin\AppData\Local\Temp\E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4808
- - C:\Users\Admin\AppData\Local\Temp\E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe
    C:\Users\Admin\AppData\Local\Temp\E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2872
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS8506~1.BAT"
      4⤵
      PID:2124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1272-139-0x00007FFA58010000-0x00007FFA58020000-memory.dmp

Filesize
64KB

Download
memory/2124-138-0x0000000000000000-mapping.dmp

Download
memory/2872-132-0x0000000000000000-mapping.dmp

Download
memory/2872-133-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2872-136-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2872-137-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4808-134-0x00000000022B0000-0x00000000022B4000-memory.dmp

Filesize
16KB

Download