cab8b3c3354158abd194e31732f27342f07ef498379a8b5af44291d322cd49c1

Analysis

max time kernel
56s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 18:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe
Size

156KB
MD5

8e9111802bf368404c2a18222b3eb986
SHA1

6a744fd5cab051d4f115a172e45d7bcb9c14c276
SHA256

2c4ca41292c07252bb043dae7697a91c140ba9be82fac5cd62c9f9c802959e0d
SHA512

67a24d236ccf08b55a0f83338f11022da506ae9c89920162e2e6ab7a79545839f3fe118adaf4d5602ce452f9192e81d380364519beb040767b9d11ed05322832
SSDEEP

3072:N2VpC7emUS2JQM2bPcmdeXTQ+LuV0/9HQZl3a12+sq:kVpC6mUVJ3IpY9x1vh

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 340 set thread context of 4608	340	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe	80

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
340	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe
340	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
340	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe
340	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 340 wrote to memory of 4608	340	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe	80
PID 340 wrote to memory of 4608	340	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe	80
PID 340 wrote to memory of 4608	340	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe	80
PID 340 wrote to memory of 4608	340	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe	80
PID 340 wrote to memory of 4608	340	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe	80
PID 340 wrote to memory of 4608	340	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe	80
PID 340 wrote to memory of 4608	340	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe	80
PID 340 wrote to memory of 4608	340	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe	80
PID 340 wrote to memory of 4608	340	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe	80
PID 4608 wrote to memory of 4328	4608	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe	81
PID 4608 wrote to memory of 4328	4608	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe	81
PID 4608 wrote to memory of 4328	4608	E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe	81

C:\Users\Admin\AppData\Local\Temp\E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe
"C:\Users\Admin\AppData\Local\Temp\E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:340
- C:\Users\Admin\AppData\Local\Temp\E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe
  C:\Users\Admin\AppData\Local\Temp\E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\ms766486.bat"
    3⤵
    PID:4328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/340-134-0x0000000004490000-0x0000000004494000-memory.dmp

Filesize
16KB

Download
memory/2688-139-0x00007FFC36B70000-0x00007FFC36B80000-memory.dmp

Filesize
64KB

Download
memory/4608-133-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4608-136-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4608-137-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download