49cd63e293adf099e468e6612b0d7cff4c4d5b3cf23cb67a7ed701e19381c2db

Analysis

max time kernel
143s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2023, 16:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Adware.PowerOffer.A.29205.8025.exe
Size 1.5MB
Sample230615-tynblaae38
SHA256 49cd63e293adf099e468e6612b0d7cff4c4d5b3cf23cb67a7ed701e19381c2db
MD5 53091df7c4510366396b3e916ca52609
SHA1 63f088c9339787ba92cf3527b592447ddd2e5806
SHA512 bd994e1a331b0f40f10ac8d015f4acffacd7887ce8d76059699f2e67009914e2afaf2bea0c6d9c2ef6ea3673fa766652495c9c53b9ab05a6d132acd1028b8870
SSDEEP 24576:5naPgVOVmMtom6KZSVvxr/c7T0pKCsHjsBuzV/qN6ZMTUMUGvKrTD3rOMeFoHGQl:5azm0Gvxr0nCsHjsBkVyTOGvWrh
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1988	SecuriteInfo.com.Adware.PowerOffer.A.29205.8025.tmp

Kills process with taskkill 4 IoCs

evasion

pid	Process
4548	taskkill.exe
216	taskkill.exe
3308	taskkill.exe
1916	taskkill.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4548	taskkill.exe
Token: SeDebugPrivilege	216	taskkill.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 1988	2440	SecuriteInfo.com.Adware.PowerOffer.A.29205.8025.exe	84
PID 2440 wrote to memory of 1988	2440	SecuriteInfo.com.Adware.PowerOffer.A.29205.8025.exe	84
PID 2440 wrote to memory of 1988	2440	SecuriteInfo.com.Adware.PowerOffer.A.29205.8025.exe	84
PID 1988 wrote to memory of 3308	1988	SecuriteInfo.com.Adware.PowerOffer.A.29205.8025.tmp	85
PID 1988 wrote to memory of 3308	1988	SecuriteInfo.com.Adware.PowerOffer.A.29205.8025.tmp	85
PID 1988 wrote to memory of 3308	1988	SecuriteInfo.com.Adware.PowerOffer.A.29205.8025.tmp	85
PID 1988 wrote to memory of 1916	1988	SecuriteInfo.com.Adware.PowerOffer.A.29205.8025.tmp	87
PID 1988 wrote to memory of 1916	1988	SecuriteInfo.com.Adware.PowerOffer.A.29205.8025.tmp	87
PID 1988 wrote to memory of 1916	1988	SecuriteInfo.com.Adware.PowerOffer.A.29205.8025.tmp	87
PID 1988 wrote to memory of 4548	1988	SecuriteInfo.com.Adware.PowerOffer.A.29205.8025.tmp	89
PID 1988 wrote to memory of 4548	1988	SecuriteInfo.com.Adware.PowerOffer.A.29205.8025.tmp	89
PID 1988 wrote to memory of 4548	1988	SecuriteInfo.com.Adware.PowerOffer.A.29205.8025.tmp	89
PID 1988 wrote to memory of 216	1988	SecuriteInfo.com.Adware.PowerOffer.A.29205.8025.tmp	91
PID 1988 wrote to memory of 216	1988	SecuriteInfo.com.Adware.PowerOffer.A.29205.8025.tmp	91
PID 1988 wrote to memory of 216	1988	SecuriteInfo.com.Adware.PowerOffer.A.29205.8025.tmp	91

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Adware.PowerOffer.A.29205.8025.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Adware.PowerOffer.A.29205.8025.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Users\Admin\AppData\Local\Temp\is-QKJDC.tmp\SecuriteInfo.com.Adware.PowerOffer.A.29205.8025.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-QKJDC.tmp\SecuriteInfo.com.Adware.PowerOffer.A.29205.8025.tmp" /SL5="$A002A,1304684,54272,C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Adware.PowerOffer.A.29205.8025.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /IM
    3⤵
    - Kills process with taskkill
    PID:3308
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /IM
    3⤵
    - Kills process with taskkill
    PID:1916
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /IM Pos.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4548
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /IM ServiceUpd.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

SecuriteInfo.com.Adware.PowerOffer.A.29205.8025.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-QKJDC.tmp\SecuriteInfo.com.Adware.PowerOffer.A.29205.8025.tmp
Size 688KB
SHA256 99c299d6565ab53d9af66e0146737dc0ecfbc52ecf4740825b552db0cc4210c6
MD5 67c5a4f36e1c91a3b85e440edd7ad026
SHA1 e49ea0e558ed682498cc61b3070e4c402fbf0912
SHA512 40522d4645ece0db9888ea40d1a11356aa5efc191184a0b97cb54a6c243532b1fc306e9095bbfa1f5dc02c8e52b709650230d1383532136e56caea3dc19a973e
SSDEEP 12288:ZRObekMtkfohrPUs37uzHnA6zgpKq35eERXprNrHIR3+j1vGgZpDExyc:jObekYkfohrP337uzHnA6cgqpeEFHR9
MD5 SHA1 SHA512 SSDEEP

Submit Download

SecuriteInfo.com.Adware.PowerOffer.A.29205.8025.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-QKJDC.tmp\SecuriteInfo.com.Adware.PowerOffer.A.29205.8025.tmp
Size 688KB
SHA256 99c299d6565ab53d9af66e0146737dc0ecfbc52ecf4740825b552db0cc4210c6
MD5 67c5a4f36e1c91a3b85e440edd7ad026
SHA1 e49ea0e558ed682498cc61b3070e4c402fbf0912
SHA512 40522d4645ece0db9888ea40d1a11356aa5efc191184a0b97cb54a6c243532b1fc306e9095bbfa1f5dc02c8e52b709650230d1383532136e56caea3dc19a973e
SSDEEP 12288:ZRObekMtkfohrPUs37uzHnA6zgpKq35eERXprNrHIR3+j1vGgZpDExyc:jObekYkfohrP337uzHnA6cgqpeEFHR9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1988-144-0x00000000005D0000-0x00000000005D1000-memory.dmp

Download

memory/1988-146-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/1988-147-0x00000000005D0000-0x00000000005D1000-memory.dmp

Download

memory/2440-133-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2440-145-0x0000000000400000-0x0000000000414000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads