2d3b9b4d0ab6d4a8a054e9e6bc51133505b52818fc557078f0f0f454b17e2274

Analysis

max time kernel
30s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
15/03/2023, 15:16

Target

Setup_patched.exe
Size

1.5MB
MD5

cd6f05944060326413c2c889596e9a4d
SHA1

6fc974572f0f56b216224f48ffac95777af7748f
SHA256

2d3b9b4d0ab6d4a8a054e9e6bc51133505b52818fc557078f0f0f454b17e2274
SHA512

2f7a9a42b6bf2f978fa7435cf256b41f13e6681d22a14d4f52bc9466ade5a9c8ae1576a0470482733d45b8182eac0eb308294a015533c77a9a08dd4ffb5f04b1
SSDEEP

12288:/EMEBfMaViZ4VsIDk1l/BvV4qK7PYbWmovpXB8OdccORWb9PkIhq9+tJi4o1+0aM:/ECZ4Vtca240FM0QawGZtCe0YgDNCO2H

Score

7^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1524 set thread context of 472	1524	Setup_patched.exe	32

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1524	Setup_patched.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 1744	1524	Setup_patched.exe	28
PID 1524 wrote to memory of 1744	1524	Setup_patched.exe	28
PID 1524 wrote to memory of 1744	1524	Setup_patched.exe	28
PID 1524 wrote to memory of 1092	1524	Setup_patched.exe	29
PID 1524 wrote to memory of 1092	1524	Setup_patched.exe	29
PID 1524 wrote to memory of 1092	1524	Setup_patched.exe	29
PID 1524 wrote to memory of 728	1524	Setup_patched.exe	30
PID 1524 wrote to memory of 728	1524	Setup_patched.exe	30
PID 1524 wrote to memory of 728	1524	Setup_patched.exe	30
PID 1524 wrote to memory of 776	1524	Setup_patched.exe	31
PID 1524 wrote to memory of 776	1524	Setup_patched.exe	31
PID 1524 wrote to memory of 776	1524	Setup_patched.exe	31
PID 1524 wrote to memory of 472	1524	Setup_patched.exe	32
PID 1524 wrote to memory of 472	1524	Setup_patched.exe	32
PID 1524 wrote to memory of 472	1524	Setup_patched.exe	32
PID 1524 wrote to memory of 472	1524	Setup_patched.exe	32
PID 1524 wrote to memory of 472	1524	Setup_patched.exe	32
PID 1524 wrote to memory of 472	1524	Setup_patched.exe	32
PID 1524 wrote to memory of 472	1524	Setup_patched.exe	32
PID 1524 wrote to memory of 472	1524	Setup_patched.exe	32
PID 1524 wrote to memory of 472	1524	Setup_patched.exe	32
PID 1524 wrote to memory of 472	1524	Setup_patched.exe	32

C:\Users\Admin\AppData\Local\Temp\Setup_patched.exe
"C:\Users\Admin\AppData\Local\Temp\Setup_patched.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"
  2⤵
  PID:1744
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:1092
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe"
  2⤵
  PID:728
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"
  2⤵
  PID:776
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:472

Initial Access

Execution

Scripting

Persistence

Privilege Escalation

Defense Evasion

Scripting

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/472-57-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1524-54-0x0000000000970000-0x0000000000AEC000-memory.dmp

Filesize
1.5MB

Download
memory/1524-55-0x00000000023B0000-0x0000000002434000-memory.dmp

Filesize
528KB

Download
memory/1524-56-0x000000001B1D0000-0x000000001B250000-memory.dmp

Filesize
512KB

Download