3ca4f44ccdd3e2c2013e1941509833362f94850dafb222530bce92598e700609 | Triage

Analysis

max time kernel
62s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2023, 23:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Enigma.exe
Size

10.1MB
MD5

0aa908b60cbb8aa7f62c12fda165eb57
SHA1

a954ebdeb6791d8c59d7bd14ff1128b652027516
SHA256

3ca4f44ccdd3e2c2013e1941509833362f94850dafb222530bce92598e700609
SHA512

20ff73b479637365ab6a5378393d4e4ffa0369410c912a9d98bdc0fce54b0c085a1312c2a94528bc6cd550033739ae184d9aa0e5ef704325d4bdafaf158184c2
SSDEEP

196608:FHLe1C283c0CtqvvbPfhpu3SaDbqrOokKoQYZf:FHyY/s0CtYDfhpHaqOokKoQYZf

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 392	2864	Enigma.exe	84
PID 2864 wrote to memory of 392	2864	Enigma.exe	84

C:\Users\Admin\AppData\Local\Temp\Enigma.exe
"C:\Users\Admin\AppData\Local\Temp\Enigma.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
  "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\Enigma.exe"
  2⤵
  PID:392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/392-144-0x0000000002990000-0x0000000002991000-memory.dmp

Filesize
4KB

Download
memory/2864-133-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download