3ae71c6ee4e9f848183283caa95183a6778d6bb93cae24cd1024b9964be11cbc

Resubmissions

21/03/2023, 01:50

230321-b9dmesgc98 1

21/03/2023, 01:42

230321-b46q1sgc73 1

Analysis

max time kernel
146s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
21/03/2023, 01:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IMG_2624_Rachel_In_The_Hotels - Mangjeol_Bong_Cha_Studio - Hwangon_Heina_Ran_Photographer.exe
Size

153KB
MD5

37932fd952d6d845927f25f42cb3c628
SHA1

d0d7e1b7cfb13a0999ef4c4733b83275a1de2440
SHA256

cb807472bb6d4d1113fcbc209d6a08fa80ff9e53c83b1aa37f9d6f549affd68c
SHA512

403dce223d9cbb4241f21a773cfc55501e4141b161c3ba60397c75d533c3abbd420a8f526f6aac7f2a0a5b7b91361ed013641f0d40afc00680428db3c1dbb49b
SSDEEP

1536:UJSV1Mq4KjdA0ejIB+7YeEsczbruUdwpiOpiq3hlV:UJKMq4KjdA0ejIB2sbbiUqhrV

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1372	wmic.exe
Token: SeSecurityPrivilege	1372	wmic.exe
Token: SeTakeOwnershipPrivilege	1372	wmic.exe
Token: SeLoadDriverPrivilege	1372	wmic.exe
Token: SeSystemProfilePrivilege	1372	wmic.exe
Token: SeSystemtimePrivilege	1372	wmic.exe
Token: SeProfSingleProcessPrivilege	1372	wmic.exe
Token: SeIncBasePriorityPrivilege	1372	wmic.exe
Token: SeCreatePagefilePrivilege	1372	wmic.exe
Token: SeBackupPrivilege	1372	wmic.exe
Token: SeRestorePrivilege	1372	wmic.exe
Token: SeShutdownPrivilege	1372	wmic.exe
Token: SeDebugPrivilege	1372	wmic.exe
Token: SeSystemEnvironmentPrivilege	1372	wmic.exe
Token: SeRemoteShutdownPrivilege	1372	wmic.exe
Token: SeUndockPrivilege	1372	wmic.exe
Token: SeManageVolumePrivilege	1372	wmic.exe
Token: 33	1372	wmic.exe
Token: 34	1372	wmic.exe
Token: 35	1372	wmic.exe
Token: 36	1372	wmic.exe
Token: SeIncreaseQuotaPrivilege	1372	wmic.exe
Token: SeSecurityPrivilege	1372	wmic.exe
Token: SeTakeOwnershipPrivilege	1372	wmic.exe
Token: SeLoadDriverPrivilege	1372	wmic.exe
Token: SeSystemProfilePrivilege	1372	wmic.exe
Token: SeSystemtimePrivilege	1372	wmic.exe
Token: SeProfSingleProcessPrivilege	1372	wmic.exe
Token: SeIncBasePriorityPrivilege	1372	wmic.exe
Token: SeCreatePagefilePrivilege	1372	wmic.exe
Token: SeBackupPrivilege	1372	wmic.exe
Token: SeRestorePrivilege	1372	wmic.exe
Token: SeShutdownPrivilege	1372	wmic.exe
Token: SeDebugPrivilege	1372	wmic.exe
Token: SeSystemEnvironmentPrivilege	1372	wmic.exe
Token: SeRemoteShutdownPrivilege	1372	wmic.exe
Token: SeUndockPrivilege	1372	wmic.exe
Token: SeManageVolumePrivilege	1372	wmic.exe
Token: 33	1372	wmic.exe
Token: 34	1372	wmic.exe
Token: 35	1372	wmic.exe
Token: 36	1372	wmic.exe
Token: SeDebugPrivilege	2184	IMG_2624_Rachel_In_The_Hotels - Mangjeol_Bong_Cha_Studio - Hwangon_Heina_Ran_Photographer.exe
Token: 33	2184	IMG_2624_Rachel_In_The_Hotels - Mangjeol_Bong_Cha_Studio - Hwangon_Heina_Ran_Photographer.exe
Token: SeIncBasePriorityPrivilege	2184	IMG_2624_Rachel_In_The_Hotels - Mangjeol_Bong_Cha_Studio - Hwangon_Heina_Ran_Photographer.exe
Token: 33	2184	IMG_2624_Rachel_In_The_Hotels - Mangjeol_Bong_Cha_Studio - Hwangon_Heina_Ran_Photographer.exe
Token: SeIncBasePriorityPrivilege	2184	IMG_2624_Rachel_In_The_Hotels - Mangjeol_Bong_Cha_Studio - Hwangon_Heina_Ran_Photographer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 1372	2184	IMG_2624_Rachel_In_The_Hotels - Mangjeol_Bong_Cha_Studio - Hwangon_Heina_Ran_Photographer.exe	85
PID 2184 wrote to memory of 1372	2184	IMG_2624_Rachel_In_The_Hotels - Mangjeol_Bong_Cha_Studio - Hwangon_Heina_Ran_Photographer.exe	85

C:\Users\Admin\AppData\Local\Temp\IMG_2624_Rachel_In_The_Hotels - Mangjeol_Bong_Cha_Studio - Hwangon_Heina_Ran_Photographer.exe
"C:\Users\Admin\AppData\Local\Temp\IMG_2624_Rachel_In_The_Hotels - Mangjeol_Bong_Cha_Studio - Hwangon_Heina_Ran_Photographer.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path win32_VideoController get name
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2184-133-0x000001F1ABF90000-0x000001F1ABFB8000-memory.dmp

Filesize
160KB

Download
memory/2184-134-0x000001F1AC3F0000-0x000001F1AC446000-memory.dmp

Filesize
344KB

Download
memory/2184-135-0x000001F1AC330000-0x000001F1AC33E000-memory.dmp

Filesize
56KB

Download
memory/2184-136-0x000001F1AC350000-0x000001F1AC35C000-memory.dmp

Filesize
48KB

Download
memory/2184-137-0x000001F1AC390000-0x000001F1AC3B4000-memory.dmp

Filesize
144KB

Download
memory/2184-138-0x000001F1AC370000-0x000001F1AC37C000-memory.dmp

Filesize
48KB

Download
memory/2184-140-0x000001F1C71D0000-0x000001F1C71E0000-memory.dmp

Filesize
64KB

Download
memory/2184-141-0x000001F1AC470000-0x000001F1AC482000-memory.dmp

Filesize
72KB

Download
memory/2184-142-0x000001F1C7730000-0x000001F1C776C000-memory.dmp

Filesize
240KB

Download
memory/2184-143-0x000001F1C77C0000-0x000001F1C7802000-memory.dmp

Filesize
264KB

Download
memory/2184-144-0x000001F1C7960000-0x000001F1C7A6A000-memory.dmp

Filesize
1.0MB

Download
memory/2184-147-0x000001F1C71A0000-0x000001F1C71B8000-memory.dmp

Filesize
96KB

Download
memory/2184-148-0x000001F1C7850000-0x000001F1C78A0000-memory.dmp

Filesize
320KB

Download
memory/2184-149-0x000001F1C71D0000-0x000001F1C71E0000-memory.dmp

Filesize
64KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads