Analysis

  • max time kernel
    28s
  • max time network
    31s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    14/06/2023, 09:04 UTC

General

  • Target

    setup.exe

  • Size

    539KB

  • MD5

    b5527fab72e933e1a479ce16f765c435

  • SHA1

    25877febe2e4dfd7318a475ad04475b2d8385a68

  • SHA256

    d86e6e98e2e1f671ec651fa60ecdfdadc069643b8865ce8230b1cc12618eb813

  • SHA512

    eeeb9f3a23f8d6c5b4c55f3177644e1faae3a97dda803e6e96b2ae9c8b60ddcfb5252102e66e2425dcee74f98f189eba0025d09ce32c053eebcded0a80ec72eb

  • SSDEEP

    12288:zuGj5je69oqAmj5oMqKyKAuqOAP0wuyeMb01JQntLOCH6o0H5:zXhe29AmjkKuuyemH6xZ

Score
1/10

Malware Config

Signatures

  • Modifies registry class 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1992
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
      2⤵
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:1956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1956-54-0x0000000000150000-0x0000000000158000-memory.dmp

    Filesize

    32KB

  • memory/1956-56-0x000000001B030000-0x000000001B0B0000-memory.dmp

    Filesize

    512KB

  • memory/1956-58-0x000000001B030000-0x000000001B0B0000-memory.dmp

    Filesize

    512KB

  • memory/1956-59-0x000000001B030000-0x000000001B0B0000-memory.dmp

    Filesize

    512KB

  • memory/1956-61-0x000000001B030000-0x000000001B0B0000-memory.dmp

    Filesize

    512KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.