a7f88bb09e886e0aa5deae2f227fa18ec1ffd7cb996441e0aacfffbd5d15146e

Analysis

max time kernel
41s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 20:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a7f88bb09e886e0aa5deae2f227fa18ec1ffd7cb996441e0aacfffbd5d15146e.exe
Size

173KB
MD5

1b76c26a5fa793dc97beeffb14fce15a
SHA1

d05731df5eeb3bd794617140e68eb3bd95bff563
SHA256

a7f88bb09e886e0aa5deae2f227fa18ec1ffd7cb996441e0aacfffbd5d15146e
SHA512

8e3594d8377bbf3938d553f3cc4a72c0eef44542f0b23e40372bcaf666cf38e9c63c89fd456e710237333506c43c96a7d23cc9604ba0a787d499f4895516767a
SSDEEP

3072:PIqELLKKHbTdIyZdRFuLt9wF+TGXAMrNjYE6Q+RcWnyZ0jU:PTwJbTdIyxFuLt9jSQMipQZWyZr

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2040 set thread context of 2020	2040	a7f88bb09e886e0aa5deae2f227fa18ec1ffd7cb996441e0aacfffbd5d15146e.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2020	a7f88bb09e886e0aa5deae2f227fa18ec1ffd7cb996441e0aacfffbd5d15146e.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2040	a7f88bb09e886e0aa5deae2f227fa18ec1ffd7cb996441e0aacfffbd5d15146e.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2020	2040	a7f88bb09e886e0aa5deae2f227fa18ec1ffd7cb996441e0aacfffbd5d15146e.exe	28
PID 2040 wrote to memory of 2020	2040	a7f88bb09e886e0aa5deae2f227fa18ec1ffd7cb996441e0aacfffbd5d15146e.exe	28
PID 2040 wrote to memory of 2020	2040	a7f88bb09e886e0aa5deae2f227fa18ec1ffd7cb996441e0aacfffbd5d15146e.exe	28
PID 2040 wrote to memory of 2020	2040	a7f88bb09e886e0aa5deae2f227fa18ec1ffd7cb996441e0aacfffbd5d15146e.exe	28
PID 2040 wrote to memory of 2020	2040	a7f88bb09e886e0aa5deae2f227fa18ec1ffd7cb996441e0aacfffbd5d15146e.exe	28
PID 2040 wrote to memory of 2020	2040	a7f88bb09e886e0aa5deae2f227fa18ec1ffd7cb996441e0aacfffbd5d15146e.exe	28
PID 2040 wrote to memory of 2020	2040	a7f88bb09e886e0aa5deae2f227fa18ec1ffd7cb996441e0aacfffbd5d15146e.exe	28
PID 2040 wrote to memory of 2020	2040	a7f88bb09e886e0aa5deae2f227fa18ec1ffd7cb996441e0aacfffbd5d15146e.exe	28
PID 2020 wrote to memory of 1220	2020	a7f88bb09e886e0aa5deae2f227fa18ec1ffd7cb996441e0aacfffbd5d15146e.exe	16
PID 2020 wrote to memory of 1220	2020	a7f88bb09e886e0aa5deae2f227fa18ec1ffd7cb996441e0aacfffbd5d15146e.exe	16
PID 2020 wrote to memory of 1220	2020	a7f88bb09e886e0aa5deae2f227fa18ec1ffd7cb996441e0aacfffbd5d15146e.exe	16
PID 2020 wrote to memory of 1220	2020	a7f88bb09e886e0aa5deae2f227fa18ec1ffd7cb996441e0aacfffbd5d15146e.exe	16
PID 2020 wrote to memory of 1220	2020	a7f88bb09e886e0aa5deae2f227fa18ec1ffd7cb996441e0aacfffbd5d15146e.exe	16
PID 2020 wrote to memory of 1220	2020	a7f88bb09e886e0aa5deae2f227fa18ec1ffd7cb996441e0aacfffbd5d15146e.exe	16

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1220
- C:\Users\Admin\AppData\Local\Temp\a7f88bb09e886e0aa5deae2f227fa18ec1ffd7cb996441e0aacfffbd5d15146e.exe
  "C:\Users\Admin\AppData\Local\Temp\a7f88bb09e886e0aa5deae2f227fa18ec1ffd7cb996441e0aacfffbd5d15146e.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Users\Admin\AppData\Local\Temp\a7f88bb09e886e0aa5deae2f227fa18ec1ffd7cb996441e0aacfffbd5d15146e.exe
    C:\Users\Admin\AppData\Local\Temp\a7f88bb09e886e0aa5deae2f227fa18ec1ffd7cb996441e0aacfffbd5d15146e.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1220-75-0x000000007EFC0000-0x000000007EFC6000-memory.dmp

Filesize
24KB

Download
memory/2020-71-0x0000000075991000-0x0000000075993000-memory.dmp

Filesize
8KB

Download
memory/2020-70-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2020-78-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2020-74-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2020-61-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2020-62-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2020-64-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2040-69-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2040-56-0x00000000002E0000-0x0000000000319000-memory.dmp

Filesize
228KB

Download
memory/2040-68-0x0000000001E00000-0x0000000001F00000-memory.dmp

Filesize
1024KB

Download
memory/2040-54-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2040-72-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2040-73-0x00000000002E0000-0x0000000000319000-memory.dmp

Filesize
228KB

Download
memory/2040-58-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2040-55-0x0000000000220000-0x0000000000224000-memory.dmp

Filesize
16KB

Download
memory/2040-57-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download