Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
14/06/2023, 09:20
General
- Target RFQ # 1045981 - MAA_D Plant Project r01.exe
- Size 765KB
- Sample230614-larp4sff4v
- SHA256 d2b52bb53b70d2c91072c917fec7a81ab9de2384eafd1abe8c66e85f5b3e85ca
Score
5/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 48 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ # 1045981 - MAA_D Plant Project r01.exe"C:\Users\Admin\AppData\Local\Temp\RFQ # 1045981 - MAA_D Plant Project r01.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1988-133-0x0000000000B00000-0x0000000000BC6000-memory.dmp
memory/1988-134-0x0000000005B90000-0x0000000006134000-memory.dmp
memory/1988-135-0x00000000055E0000-0x0000000005672000-memory.dmp
memory/1988-136-0x0000000005AC0000-0x0000000005ACA000-memory.dmp
memory/1988-137-0x0000000005750000-0x0000000005760000-memory.dmp
memory/1988-138-0x0000000005750000-0x0000000005760000-memory.dmp
memory/1988-139-0x0000000008F30000-0x0000000008FCC000-memory.dmp
memory/4784-140-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4784-142-0x0000000000F10000-0x000000000125A000-memory.dmp
memory/4784-143-0x0000000000400000-0x000000000042F000-memory.dmp