c304bf933722c228b75e5f26af3b73fe1b13b1cd5fbc0bd9062cd558b5e6807b | Triage

Analysis

max time kernel
87s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/01/2023, 03:44

Sharing

Report Analysis Logs

General

Target

Setup.exe
Size

726.3MB
MD5

d53d997634983fc146833c30779a492d
SHA1

140e785f3b5ba065550d5e4fb0aaedcc6587c101
SHA256

8932060cf8a7e62a1bac0f4150148797623e7443944ecbe38cec1c8fd9a2a30e
SHA512

e8a814c3eeb379d680285bde8bea27d3a4d8c1d246e4b1f1060af393461f0e908b0bc70c7f24e8d1569d7b558287e94d9a6834b5b93be9dcf4ed10b35139985b
SSDEEP

196608:FVBvfkXNSXMFcaAraPmOxd8hqbPjGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGR:FvfkX46SOxmIw

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2276	Setup.exe
2276	Setup.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2276	Setup.exe
2276	Setup.exe

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2276-132-0x0000000000400000-0x0000000000DF5000-memory.dmp

Filesize
10.0MB

Download
memory/2276-134-0x0000000000400000-0x0000000000DF5000-memory.dmp

Filesize
10.0MB

Download
memory/2276-135-0x0000000000400000-0x0000000000DF5000-memory.dmp

Filesize
10.0MB

Download