1a2de110248c93889768657273bdab9972b89b6b0dac8b2c83cdf2f5d45f80f6 | Triage

Analysis

max time kernel
37s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-01-2023 19:19

Sharing

Report Analysis Logs

General

Target

Setup_soft.exe
Size

6.4MB
MD5

34ed962ae522fd0a6327b23fa8932cf2
SHA1

20bddced3bf506f535efe74cdd32ddf44a159352
SHA256

1a2de110248c93889768657273bdab9972b89b6b0dac8b2c83cdf2f5d45f80f6
SHA512

2a47fcef7c88dbd072de0e9e17d45c4663c1ede05ad881ec3772dc6af30eb07fe40d0a912d91a94c9b5cf7b4399c1a67503e2c6a58c07f2814e8f8e97eb2e444
SSDEEP

98304:Y5I5x3omArylYOI5CAaT+dPas2Yv0zcBWc1fldTRwaykXf1:15xqyoaT+dPB2mwq7T5bXf

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1772 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1772 powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Setup_soft.exe

description	pid	process	target process
PID 1988 wrote to memory of 1772	1988	Setup_soft.exe	powershell.exe
PID 1988 wrote to memory of 1772	1988	Setup_soft.exe	powershell.exe
PID 1988 wrote to memory of 1772	1988	Setup_soft.exe	powershell.exe
PID 1988 wrote to memory of 1772	1988	Setup_soft.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\Setup_soft.exe
"C:\Users\Admin\AppData\Local\Temp\Setup_soft.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1988

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:/Windows/SysWOW64/WindowsPowerShell/v1.0/powershell.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1772

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1772-56-0x0000000000000000-mapping.dmp

Download
memory/1772-58-0x0000000073140000-0x00000000736EB000-memory.dmp

Filesize
5.7MB

Download
memory/1772-59-0x0000000073140000-0x00000000736EB000-memory.dmp

Filesize
5.7MB

Download
memory/1988-54-0x00000000010B0000-0x000000000171C000-memory.dmp

Filesize
6.4MB

Download
memory/1988-55-0x0000000075A91000-0x0000000075A93000-memory.dmp

Filesize
8KB

Download