1c71f683de6519775ba2973f11b22a7d4a4e4e94ad7073689ae7bcb57a6cbdd6

Analysis

max time kernel
41s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 18:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe
Size

176KB
MD5

13997ebf7af8d37dda6697ac03f76cc3
SHA1

9be2bcd498406bdfb05f860ad726273c4a7b4f3a
SHA256

11ecf58db103eb2ded5b942f303d48b5d77e336b8edfe335fa7b81264d1f50ef
SHA512

2894ef41ec784fb39ec663ff8ca5fa8c0ebbd875f95f6e2b843c8bca59d63cc7c43f64df43898290cef31c4b32478819f437fcc4656606d0f7cd4721c735ffee
SSDEEP

3072:rGwR1qmB1TQgHtMF5a6I4Ya5Tlrjmvl3XymSPTyAAwoc9+IkMd+zr3/1C:7KLa6I4x3mdnCNAwo42M

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4492 set thread context of 4160	4492	2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe	83

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4492	2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe
4492	2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe
4160	2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe
4160	2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4160	2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4492	2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe
4492	2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 4160	4492	2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe	83
PID 4492 wrote to memory of 4160	4492	2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe	83
PID 4492 wrote to memory of 4160	4492	2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe	83
PID 4492 wrote to memory of 4160	4492	2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe	83
PID 4492 wrote to memory of 4160	4492	2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe	83
PID 4492 wrote to memory of 4160	4492	2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe	83
PID 4492 wrote to memory of 4160	4492	2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe	83
PID 4492 wrote to memory of 4160	4492	2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe	83
PID 4492 wrote to memory of 4160	4492	2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe	83
PID 4160 wrote to memory of 5116	4160	2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe	84
PID 4160 wrote to memory of 5116	4160	2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe	84
PID 4160 wrote to memory of 5116	4160	2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe	84
PID 4160 wrote to memory of 752	4160	2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe	42

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:752
- C:\Users\Admin\AppData\Local\Temp\2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe
  "C:\Users\Admin\AppData\Local\Temp\2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\Users\Admin\AppData\Local\Temp\2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe
    C:\Users\Admin\AppData\Local\Temp\2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4160
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS7753~1.BAT"
      4⤵
      PID:5116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4160-134-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4160-137-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4492-132-0x0000000000400000-0x0000000000520000-memory.dmp

Filesize
1.1MB

Download
memory/4492-136-0x0000000000400000-0x0000000000520000-memory.dmp

Filesize
1.1MB

Download
memory/4492-138-0x0000000002460000-0x0000000002464000-memory.dmp

Filesize
16KB

Download