Analysis
-
max time kernel
147s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
26/05/2023, 14:57
General
-
Target
Purchase Order_ ENQ REF_PDF____________________________..exe
-
Size
692KB
-
MD5
83266c7c6cdde4dda499c3b866762aa6
-
SHA1
77dd4f84291f19dd868f43d397bc9a420e584520
-
SHA256
032454dace97a2e1d466b0a2749f8a3fbaac125c110a89f43a1ecac98aa05b49
-
SHA512
e1139db61e55307c926c545df8fae27b7327f5c419b40df1934500f69e17747ca403ad92e4386491c66962bf80a2c3f136570e531d818eac551c33f72da3d94b
-
SSDEEP
12288:vKd7z5GoJiGaq5auljBSN3sVS5TazUl4Lv/xXoVK8Dis77EfGF+VCp:c5GoR5a+VV1ol4jiV5DLP3F+V6
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 46 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order_ ENQ REF_PDF____________________________..exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order_ ENQ REF_PDF____________________________..exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order_ ENQ REF_PDF____________________________..exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order_ ENQ REF_PDF____________________________..exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
188KB
-
Filesize
3.3MB
-
Filesize
188KB
-
Filesize
720KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
624KB