79403994107dccd355ddf6638cc191b60f05a8b7760a6fc02bf00548a13cd3f3 | Triage

Analysis

max time kernel
30s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-01-2023 00:54

Sharing

Report Analysis Logs

General

Target

Setup_soft.exe
Size

7.0MB
MD5

6e1e121b326c1fbacdbbfa31dfa9fe2c
SHA1

61a755cb930c4ce7b8aab7106b0aa7b08b427b92
SHA256

79403994107dccd355ddf6638cc191b60f05a8b7760a6fc02bf00548a13cd3f3
SHA512

c1d5d073bf679d8fe3de6e5f681fe0f382ef1d79d6a153e5bf18cd4d166a577b30f493e8e1b7c7063d25e990337dbc5f621efc31db6e88a10be95df43394a98f
SSDEEP

98304:Y5I5x3omArylYOI5CAaT+dPas2Yv0zcBWc1fldTRwaykXf1Dt4:15xqyoaT+dPB2mwq7T5bXfA

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1400 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1400 powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Setup_soft.exe

description	pid	process	target process
PID 844 wrote to memory of 1400	844	Setup_soft.exe	powershell.exe
PID 844 wrote to memory of 1400	844	Setup_soft.exe	powershell.exe
PID 844 wrote to memory of 1400	844	Setup_soft.exe	powershell.exe
PID 844 wrote to memory of 1400	844	Setup_soft.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\Setup_soft.exe
"C:\Users\Admin\AppData\Local\Temp\Setup_soft.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:844

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:/Windows/SysWOW64/WindowsPowerShell/v1.0/powershell.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/844-54-0x0000000000040000-0x00000000006AC000-memory.dmp

Filesize
6.4MB

Download
memory/844-55-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download
memory/1400-56-0x0000000000000000-mapping.dmp

Download
memory/1400-58-0x0000000072F00000-0x00000000734AB000-memory.dmp

Filesize
5.7MB

Download
memory/1400-59-0x0000000072F00000-0x00000000734AB000-memory.dmp

Filesize
5.7MB

Download