Analysis
-
max time kernel
144s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
12-06-2023 08:58
General
-
Target
SC621092.exe
-
Size
832KB
-
MD5
f8efcba2959be68aa3ac02e97e57462b
-
SHA1
12d63474867d4e3f8c9817931e033a7f88b31bd7
-
SHA256
9eee55870f96064bcff1483074720ac2f5b19da69ee94f72f04a6e8b8b1e8290
-
SHA512
d2d65a5e9f38822b2bb2fa482b1e870931ddca46cd57e423c2d7961e396b4f3c0c27aa86715168d787156165dd8966ef198ff68547f08a2883277f97397ca257
-
SSDEEP
24576:jV1mOV/NOa0WXTRVYUtbS+D9+HX1uH5vzIz5Z:jVUOV/NOazfY8bZQHX1uH5vzIz7
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 42 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SC621092.exe"C:\Users\Admin\AppData\Local\Temp\SC621092.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SC621092.exe"C:\Users\Admin\AppData\Local\Temp\SC621092.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
3.3MB
-
Filesize
856KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
624KB