8ec6230482badb0211902e2d2e563a9b878f47ba7ff4fa22c4bbb15426a9a99c | Triage

Resubmissions

26-06-2023 16:03

230626-thnmesad46 10

22-06-2023 21:47

230622-1nf8vsbc4t 10

Analysis

max time kernel
32s
max time network
35s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
22-06-2023 21:47

Sharing

Report Analysis Logs

General

Target

Installer-Wizard_v1.4o.7n_patched.exe
Size

151KB
MD5

3950c1e15b18007b3ee172a178fda0f8
SHA1

73345e1d1f324d93874e7de3bde75528ca30983c
SHA256

8ec6230482badb0211902e2d2e563a9b878f47ba7ff4fa22c4bbb15426a9a99c
SHA512

9575cca3db94074c1acd59c4aa7bf41663f6db16bd3b61a13cc767ac3a2d841323d285102a3807c6a7387cc49690ddea78dd0692dee14717693d3144089ad7ad
SSDEEP

3072:mgGJB5QpCwS40nLbL7kRDzz8LhAsT+Egm:mgIBOpCLXL7kZz8Cm

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

840 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 840 powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Installer-Wizard_v1.4o.7n_patched.exe

description	pid	process	target process
PID 1092 wrote to memory of 840	1092	Installer-Wizard_v1.4o.7n_patched.exe	powershell.exe
PID 1092 wrote to memory of 840	1092	Installer-Wizard_v1.4o.7n_patched.exe	powershell.exe
PID 1092 wrote to memory of 840	1092	Installer-Wizard_v1.4o.7n_patched.exe	powershell.exe
PID 1092 wrote to memory of 840	1092	Installer-Wizard_v1.4o.7n_patched.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\Installer-Wizard_v1.4o.7n_patched.exe
"C:\Users\Admin\AppData\Local\Temp\Installer-Wizard_v1.4o.7n_patched.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1092

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/840-58-0x00000000026B0000-0x00000000026F0000-memory.dmp

Filesize
256KB

Download
memory/1092-54-0x00000000003C0000-0x0000000004E06000-memory.dmp

Filesize
74.3MB

Download
memory/1092-55-0x0000000005090000-0x00000000050D0000-memory.dmp

Filesize
256KB

Download
memory/1092-59-0x0000000005090000-0x00000000050D0000-memory.dmp

Filesize
256KB

Download