3ae71c6ee4e9f848183283caa95183a6778d6bb93cae24cd1024b9964be11cbc

Resubmissions

21/03/2023, 01:50

230321-b9dmesgc98 1

21/03/2023, 01:42

230321-b46q1sgc73 1

Analysis

max time kernel
145s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
21/03/2023, 01:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IMG_3318_Rachel_In_The_Hotels - Mangjeol_Bong_Cha_Studio - Hwangon_Heina_Ran_Photographer.exe
Size

153KB
MD5

37932fd952d6d845927f25f42cb3c628
SHA1

d0d7e1b7cfb13a0999ef4c4733b83275a1de2440
SHA256

cb807472bb6d4d1113fcbc209d6a08fa80ff9e53c83b1aa37f9d6f549affd68c
SHA512

403dce223d9cbb4241f21a773cfc55501e4141b161c3ba60397c75d533c3abbd420a8f526f6aac7f2a0a5b7b91361ed013641f0d40afc00680428db3c1dbb49b
SSDEEP

1536:UJSV1Mq4KjdA0ejIB+7YeEsczbruUdwpiOpiq3hlV:UJKMq4KjdA0ejIB2sbbiUqhrV

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2456	wmic.exe
Token: SeSecurityPrivilege	2456	wmic.exe
Token: SeTakeOwnershipPrivilege	2456	wmic.exe
Token: SeLoadDriverPrivilege	2456	wmic.exe
Token: SeSystemProfilePrivilege	2456	wmic.exe
Token: SeSystemtimePrivilege	2456	wmic.exe
Token: SeProfSingleProcessPrivilege	2456	wmic.exe
Token: SeIncBasePriorityPrivilege	2456	wmic.exe
Token: SeCreatePagefilePrivilege	2456	wmic.exe
Token: SeBackupPrivilege	2456	wmic.exe
Token: SeRestorePrivilege	2456	wmic.exe
Token: SeShutdownPrivilege	2456	wmic.exe
Token: SeDebugPrivilege	2456	wmic.exe
Token: SeSystemEnvironmentPrivilege	2456	wmic.exe
Token: SeRemoteShutdownPrivilege	2456	wmic.exe
Token: SeUndockPrivilege	2456	wmic.exe
Token: SeManageVolumePrivilege	2456	wmic.exe
Token: 33	2456	wmic.exe
Token: 34	2456	wmic.exe
Token: 35	2456	wmic.exe
Token: 36	2456	wmic.exe
Token: SeIncreaseQuotaPrivilege	2456	wmic.exe
Token: SeSecurityPrivilege	2456	wmic.exe
Token: SeTakeOwnershipPrivilege	2456	wmic.exe
Token: SeLoadDriverPrivilege	2456	wmic.exe
Token: SeSystemProfilePrivilege	2456	wmic.exe
Token: SeSystemtimePrivilege	2456	wmic.exe
Token: SeProfSingleProcessPrivilege	2456	wmic.exe
Token: SeIncBasePriorityPrivilege	2456	wmic.exe
Token: SeCreatePagefilePrivilege	2456	wmic.exe
Token: SeBackupPrivilege	2456	wmic.exe
Token: SeRestorePrivilege	2456	wmic.exe
Token: SeShutdownPrivilege	2456	wmic.exe
Token: SeDebugPrivilege	2456	wmic.exe
Token: SeSystemEnvironmentPrivilege	2456	wmic.exe
Token: SeRemoteShutdownPrivilege	2456	wmic.exe
Token: SeUndockPrivilege	2456	wmic.exe
Token: SeManageVolumePrivilege	2456	wmic.exe
Token: 33	2456	wmic.exe
Token: 34	2456	wmic.exe
Token: 35	2456	wmic.exe
Token: 36	2456	wmic.exe
Token: SeDebugPrivilege	3672	IMG_3318_Rachel_In_The_Hotels - Mangjeol_Bong_Cha_Studio - Hwangon_Heina_Ran_Photographer.exe
Token: 33	3672	IMG_3318_Rachel_In_The_Hotels - Mangjeol_Bong_Cha_Studio - Hwangon_Heina_Ran_Photographer.exe
Token: SeIncBasePriorityPrivilege	3672	IMG_3318_Rachel_In_The_Hotels - Mangjeol_Bong_Cha_Studio - Hwangon_Heina_Ran_Photographer.exe
Token: 33	3672	IMG_3318_Rachel_In_The_Hotels - Mangjeol_Bong_Cha_Studio - Hwangon_Heina_Ran_Photographer.exe
Token: SeIncBasePriorityPrivilege	3672	IMG_3318_Rachel_In_The_Hotels - Mangjeol_Bong_Cha_Studio - Hwangon_Heina_Ran_Photographer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 2456	3672	IMG_3318_Rachel_In_The_Hotels - Mangjeol_Bong_Cha_Studio - Hwangon_Heina_Ran_Photographer.exe	85
PID 3672 wrote to memory of 2456	3672	IMG_3318_Rachel_In_The_Hotels - Mangjeol_Bong_Cha_Studio - Hwangon_Heina_Ran_Photographer.exe	85

C:\Users\Admin\AppData\Local\Temp\IMG_3318_Rachel_In_The_Hotels - Mangjeol_Bong_Cha_Studio - Hwangon_Heina_Ran_Photographer.exe
"C:\Users\Admin\AppData\Local\Temp\IMG_3318_Rachel_In_The_Hotels - Mangjeol_Bong_Cha_Studio - Hwangon_Heina_Ran_Photographer.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path win32_VideoController get name
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3672-133-0x00000255AD730000-0x00000255AD758000-memory.dmp

Filesize
160KB

Download
memory/3672-134-0x00000255ADAF0000-0x00000255ADB46000-memory.dmp

Filesize
344KB

Download
memory/3672-135-0x00000255ADAB0000-0x00000255ADABE000-memory.dmp

Filesize
56KB

Download
memory/3672-136-0x00000255ADAD0000-0x00000255ADADC000-memory.dmp

Filesize
48KB

Download
memory/3672-137-0x00000255C87F0000-0x00000255C8814000-memory.dmp

Filesize
144KB

Download
memory/3672-138-0x00000255ADB70000-0x00000255ADB7C000-memory.dmp

Filesize
48KB

Download
memory/3672-140-0x00000255C8900000-0x00000255C8910000-memory.dmp

Filesize
64KB

Download
memory/3672-141-0x00000255AF480000-0x00000255AF492000-memory.dmp

Filesize
72KB

Download
memory/3672-142-0x00000255C8860000-0x00000255C889C000-memory.dmp

Filesize
240KB

Download
memory/3672-143-0x00000255C8F20000-0x00000255C8F62000-memory.dmp

Filesize
264KB

Download
memory/3672-144-0x00000255C90A0000-0x00000255C91AA000-memory.dmp

Filesize
1.0MB

Download
memory/3672-147-0x00000255C8820000-0x00000255C8838000-memory.dmp

Filesize
96KB

Download
memory/3672-148-0x00000255C8F90000-0x00000255C8FE0000-memory.dmp

Filesize
320KB

Download
memory/3672-149-0x00000255C8900000-0x00000255C8910000-memory.dmp

Filesize
64KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads