Overview

overview

10

Static

static

SecuriteIn...96.exe

windows7-x64

7

SecuriteIn...96.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    39s
  • max time network
    47s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    09-12-2022 10:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Trojan.PackedNET.1293.27162.15596.exe

  • Size

    660KB

  • MD5

    873bfbea840976bb63f1e7eae546725e

  • SHA1

    7175df3680987e75f1ebb7430c8246400ebf71f4

  • SHA256

    9e9f338d922f809d4ecac31b1b2c1bc38de325e848782308997d76eef549951f

  • SHA512

    f3916908c555f105c3bc293d7d27e5592381a8586dda4d4771742bb537a84040d9d538447b8d22571d941b0caed9443f264b0bf495a7745fb556d9a7b58cdc87

  • SSDEEP

    6144:k4uIrm6rLfOhXDBkyFhI8OZiLsyJ0If3+Nm3cxgU/ZzU:kv6rLClkyFhI8OZiIyJ1us3cxgU/Zz

Score
7/10

Malware Config

Signatures

  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1293.27162.15596.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1293.27162.15596.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1920
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      2⤵
        PID:1364
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        2⤵
          PID:1372
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
          2⤵
            PID:1732
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
            2⤵
              PID:1232
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
              2⤵
                PID:1348

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/1920-54-0x0000000000270000-0x0000000000316000-memory.dmp

              Filesize

              664KB

              Download

            • memory/1920-55-0x0000000000240000-0x000000000024A000-memory.dmp

              Filesize

              40KB

              Download