Analysis

  • max time kernel
    75s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-01-2023 10:39

General

  • Target

    requirements.scr

  • Size

    1MB

  • MD5

    79fa39ca211a380dc98c482efc464d80

  • SHA1

    18f708df88acc2bfcbf4c0c92e592e07c163d579

  • SHA256

    3aac32ecf3dc6c3cc6134ebff428b39f2ca7e60135d750b530028b13d1e11a47

  • SHA512

    112e085a5aa9c47f3613b6ff8d0d9c637f0bd53f8001a37b52199d10a01dcedf702a445ac0f6ff2eb4e8e3fecc3d586417d74943e05321ef9ef816092ec0daca

  • SSDEEP

    6144:zK1RwjnNcXRMdFoMXtYBX2q+QG1MZRVC1/EoUHxyJwq5m1IP:jjnihOdQY0ia1

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\requirements.scr
    "C:\Users\Admin\AppData\Local\Temp\requirements.scr" /S
    • Suspicious use of WriteProcessMemory
    PID:5056
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:/Windows/SysWOW64/WindowsPowerShell/v1.0/powershell.exe"
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4804-141-0x0000000005600000-0x0000000005666000-memory.dmp
    Filesize

    408KB

  • memory/4804-140-0x0000000005420000-0x0000000005486000-memory.dmp
    Filesize

    408KB

  • memory/4804-146-0x0000000007000000-0x000000000701A000-memory.dmp
    Filesize

    104KB

  • memory/4804-145-0x0000000007660000-0x0000000007CDA000-memory.dmp
    Filesize

    6MB

  • memory/4804-136-0x0000000000000000-mapping.dmp
  • memory/4804-137-0x0000000002380000-0x00000000023B6000-memory.dmp
    Filesize

    216KB

  • memory/4804-144-0x0000000006D60000-0x0000000006DD6000-memory.dmp
    Filesize

    472KB

  • memory/4804-139-0x0000000004C90000-0x0000000004CB2000-memory.dmp
    Filesize

    136KB

  • memory/4804-138-0x0000000004DF0000-0x0000000005418000-memory.dmp
    Filesize

    6MB

  • memory/4804-143-0x0000000006200000-0x0000000006244000-memory.dmp
    Filesize

    272KB

  • memory/4804-142-0x0000000005C80000-0x0000000005C9E000-memory.dmp
    Filesize

    120KB

  • memory/5056-132-0x0000000000C20000-0x0000000000C6C000-memory.dmp
    Filesize

    304KB

  • memory/5056-133-0x0000000005CB0000-0x0000000006254000-memory.dmp
    Filesize

    5MB

  • memory/5056-135-0x00000000056A0000-0x00000000056AA000-memory.dmp
    Filesize

    40KB

  • memory/5056-134-0x00000000055F0000-0x0000000005682000-memory.dmp
    Filesize

    584KB