58a7d4f557e04cf695287a1521069f4008c0f451d524037e6ae20b3089d2be74

Analysis

max time kernel
81s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2023, 08:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 1.2MB
Sample230703-jxpg6afe66
SHA256 58a7d4f557e04cf695287a1521069f4008c0f451d524037e6ae20b3089d2be74
MD5 abc8ad6946808c33d794bd553b7e1657
SHA1 a95363691981e04f6aff00c2a95972f4a74908b1
SHA512 d589eebd73e07a6bb873544d51f0618731688409a09f44bcc1a345c3490a7b60086bd23a02b922cd48323e9132336fa9ca45b531ea49f217497610d810ddefe1
SSDEEP 6144:sywKlkwrO7P+UMrwgz5CAOjMp5FxZjs6igVc/Wj6JrbgRK76O:sjGkwrO7PUNCxYv1/6dys
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4244 set thread context of 4972	4244	file.exe	80

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4972	InstallUtil.exe
4972	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4972	InstallUtil.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 4972	4244	file.exe	80
PID 4244 wrote to memory of 4972	4244	file.exe	80
PID 4244 wrote to memory of 4972	4244	file.exe	80
PID 4244 wrote to memory of 4972	4244	file.exe	80
PID 4244 wrote to memory of 4972	4244	file.exe	80
PID 4244 wrote to memory of 4972	4244	file.exe	80
PID 4244 wrote to memory of 4972	4244	file.exe	80
PID 4244 wrote to memory of 4972	4244	file.exe	80

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4972-133-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4972-134-0x00000000079E0000-0x0000000007FF8000-memory.dmp

Download

memory/4972-135-0x0000000007470000-0x0000000007482000-memory.dmp

Download

memory/4972-136-0x00000000075A0000-0x00000000076AA000-memory.dmp

Download

memory/4972-137-0x0000000007510000-0x000000000754C000-memory.dmp

Download

memory/4972-138-0x00000000074C0000-0x00000000074D0000-memory.dmp

Download

memory/4972-139-0x0000000007830000-0x0000000007896000-memory.dmp

Download

memory/4972-140-0x00000000088E0000-0x0000000008E84000-memory.dmp

Download

memory/4972-141-0x0000000008410000-0x00000000084A2000-memory.dmp

Download

memory/4972-142-0x00000000085C0000-0x0000000008636000-memory.dmp

Download

memory/4972-143-0x0000000008E90000-0x0000000009052000-memory.dmp

Download

memory/4972-144-0x0000000009590000-0x0000000009ABC000-memory.dmp

Download

memory/4972-145-0x0000000008740000-0x000000000875E000-memory.dmp

Download

memory/4972-146-0x0000000008890000-0x00000000088E0000-memory.dmp

Download