2f90da6517ba31d42cd907480ded408e711761fb727c89baef821e040485365a | Triage

Analysis

max time kernel
68s
max time network
152s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 09:37

Sharing

Report Analysis Logs

General

Target

VmManagedSetup.exe
Size

13KB
MD5

383a80304cc43365619d7e20b9d54d56
SHA1

299894d56be26ca9304927848951235c61322fef
SHA256

2f90da6517ba31d42cd907480ded408e711761fb727c89baef821e040485365a
SHA512

2d8442c6863b0dd733e6adebe5ff16b8e5e33446b2313e1e8077cd10ae94c5b1ed95a890ba7025fc2872e8a5c0de65f860a0a89cd71b6d6e0131289220437561
SSDEEP

192:TJCWT9Z1evE5DW/npyaPa3X4HTyT8Lem1mu9yaHOkrUNlM:T5T9Z0vV/nQaWoH+T8qc59ywrUN

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 2 IoCs

Processes:

VmManagedSetup.exe

description	ioc	process
File created	C:\Windows\Tasks\wow64.job	VmManagedSetup.exe
File opened for modification	C:\Windows\Tasks\wow64.job	VmManagedSetup.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 1996 wrote to memory of 964	1996	taskeng.exe	VmManagedSetup.exe
PID 1996 wrote to memory of 964	1996	taskeng.exe	VmManagedSetup.exe
PID 1996 wrote to memory of 964	1996	taskeng.exe	VmManagedSetup.exe
PID 1996 wrote to memory of 964	1996	taskeng.exe	VmManagedSetup.exe
PID 1996 wrote to memory of 964	1996	taskeng.exe	VmManagedSetup.exe
PID 1996 wrote to memory of 964	1996	taskeng.exe	VmManagedSetup.exe
PID 1996 wrote to memory of 964	1996	taskeng.exe	VmManagedSetup.exe

C:\Users\Admin\AppData\Local\Temp\VmManagedSetup.exe
"C:\Users\Admin\AppData\Local\Temp\VmManagedSetup.exe"
1⤵
- Drops file in Windows directory
PID:1976

C:\Windows\system32\taskeng.exe
taskeng.exe {E9A4CF5C-0F5F-4921-91D0-5E32AAA8C82A} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1996

C:\Users\Admin\AppData\Local\Temp\VmManagedSetup.exe
C:\Users\Admin\AppData\Local\Temp\VmManagedSetup.exe start
2⤵
PID:964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/964-55-0x0000000000000000-mapping.dmp

Download
memory/1976-54-0x0000000074D81000-0x0000000074D83000-memory.dmp

Filesize
8KB

Download