3f4ab40f84b5044f436b076024787a62f5444ab3549f49f8460ca6a72f949d00 | Triage

Resubmissions

13/01/2023, 12:35

230113-pshfyagh56 10

10/01/2023, 12:21

230110-pjc5vsfh98 5

Analysis

max time kernel
40s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
10/01/2023, 12:21

Sharing

Report Analysis Logs

General

Target

Setup.exe
Size

450.0MB
MD5

cb2b683c08069259a1ad4eaa829cfeb4
SHA1

acae6f70cf1e360bb3656e936c45ca14d448f8c1
SHA256

0f08546b9b68ffd107a9bfb61985f1f07b7418e8a78b73eec441f8bbf2396de7
SHA512

7741c2e7ed7b62e930be73f1a49a17019ecd36a84bde628b50dd055d6e2940938f089f8c272a4a578af1db569b7ff702744d87762ea5fac1cbc019320b062e03
SSDEEP

24576:+S02yH58BY5FHoJhxIeeE98PKmyChWjzbyqo53xre6:o5t51pWkSyqo5Y

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1404 set thread context of 1712	1404	Setup.exe	28

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 1712	1404	Setup.exe	28
PID 1404 wrote to memory of 1712	1404	Setup.exe	28
PID 1404 wrote to memory of 1712	1404	Setup.exe	28
PID 1404 wrote to memory of 1712	1404	Setup.exe	28
PID 1404 wrote to memory of 1712	1404	Setup.exe	28
PID 1404 wrote to memory of 1712	1404	Setup.exe	28
PID 1404 wrote to memory of 1712	1404	Setup.exe	28
PID 1404 wrote to memory of 1712	1404	Setup.exe	28
PID 1404 wrote to memory of 1712	1404	Setup.exe	28
PID 1404 wrote to memory of 1712	1404	Setup.exe	28
PID 1404 wrote to memory of 1712	1404	Setup.exe	28
PID 1404 wrote to memory of 1712	1404	Setup.exe	28
PID 1404 wrote to memory of 1712	1404	Setup.exe	28

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:1712

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1404-54-0x0000000000040000-0x00000000001DE000-memory.dmp

Filesize
1.6MB

Download
memory/1404-55-0x00000000006E0000-0x0000000000760000-memory.dmp

Filesize
512KB

Download
memory/1712-56-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download