53e891f9b9098e2f7f29c3129ff55d16faa213ac9d07efbb5443d0d42809adf2

Analysis

max time kernel
140s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2023, 13:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CAMSCANNER-2023.07.11.exe
Size

85KB
MD5

1c2d00ad527ad7a0d3165c78e6a42cdf
SHA1

366de59ddda44aef246e4e61a06682af15852214
SHA256

53e891f9b9098e2f7f29c3129ff55d16faa213ac9d07efbb5443d0d42809adf2
SHA512

1cf42328be4f664928cbba298b95b4245a13c0e805457fe88932872d560abb0937f0d6e0f49bb65670d26d59546a0890c19a00ab668516378fbea4d9e7e1bc36
SSDEEP

1536:sTdw6Mf5lpZBYkDkhEzF3sydyc4F9nY++cuq/x8ir0ct41qyfZbdTsUXU8wU2gud:QdFS5lKStmFpJJ/xvr0cSPTdYNj11z

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Onlyxwfsz = "C:\\Users\\Admin\\AppData\\Roaming\\Onlyxwfsz.exe"	CAMSCANNER-2023.07.11.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3960 set thread context of 4676	3960	CAMSCANNER-2023.07.11.exe	93

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3960	CAMSCANNER-2023.07.11.exe
Token: SeDebugPrivilege	4676	CAMSCANNER-2023.07.11.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3960 wrote to memory of 4676	3960	CAMSCANNER-2023.07.11.exe	93
PID 3960 wrote to memory of 4676	3960	CAMSCANNER-2023.07.11.exe	93
PID 3960 wrote to memory of 4676	3960	CAMSCANNER-2023.07.11.exe	93
PID 3960 wrote to memory of 4676	3960	CAMSCANNER-2023.07.11.exe	93
PID 3960 wrote to memory of 4676	3960	CAMSCANNER-2023.07.11.exe	93
PID 3960 wrote to memory of 4676	3960	CAMSCANNER-2023.07.11.exe	93

C:\Users\Admin\AppData\Local\Temp\CAMSCANNER-2023.07.11.exe
"C:\Users\Admin\AppData\Local\Temp\CAMSCANNER-2023.07.11.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3960
- C:\Users\Admin\AppData\Local\Temp\CAMSCANNER-2023.07.11.exe
  C:\Users\Admin\AppData\Local\Temp\CAMSCANNER-2023.07.11.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4676

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\CAMSCANNER-2023.07.11.exe.log

Filesize
1KB

MD5
837f5f89a32c72306ecb0f0a1562d4ba

SHA1
e487a7dbf251e45764dd4f0ff86a5fc1492ca18c

SHA256
f9b02cf723902238ddf66a70ef30edbe70d738b308800a97a6c0bef3ed7e41fe

SHA512
0bc7dfd358456e643e886bd110c7c7c1f58dcf4863169a3f186dc7e8a2a3f437000fdc311dbd2cfde571118076bef3f16ba01191e0e3220011b9fd80a155148a

Download Submit
memory/3960-169-0x000002BFBFC00000-0x000002BFBFD96000-memory.dmp

Filesize
1.6MB

Download
memory/3960-173-0x000002BFBFC00000-0x000002BFBFD96000-memory.dmp

Filesize
1.6MB

Download
memory/3960-136-0x000002BFBFC00000-0x000002BFBFD96000-memory.dmp

Filesize
1.6MB

Download
memory/3960-137-0x000002BFBFC00000-0x000002BFBFD96000-memory.dmp

Filesize
1.6MB

Download
memory/3960-139-0x000002BFBFC00000-0x000002BFBFD96000-memory.dmp

Filesize
1.6MB

Download
memory/3960-141-0x000002BFBFC00000-0x000002BFBFD96000-memory.dmp

Filesize
1.6MB

Download
memory/3960-143-0x000002BFBFC00000-0x000002BFBFD96000-memory.dmp

Filesize
1.6MB

Download
memory/3960-145-0x000002BFBFC00000-0x000002BFBFD96000-memory.dmp

Filesize
1.6MB

Download
memory/3960-147-0x000002BFBFC00000-0x000002BFBFD96000-memory.dmp

Filesize
1.6MB

Download
memory/3960-149-0x000002BFBFC00000-0x000002BFBFD96000-memory.dmp

Filesize
1.6MB

Download
memory/3960-151-0x000002BFBFC00000-0x000002BFBFD96000-memory.dmp

Filesize
1.6MB

Download
memory/3960-153-0x000002BFBFC00000-0x000002BFBFD96000-memory.dmp

Filesize
1.6MB

Download
memory/3960-155-0x000002BFBFC00000-0x000002BFBFD96000-memory.dmp

Filesize
1.6MB

Download
memory/3960-157-0x000002BFBFC00000-0x000002BFBFD96000-memory.dmp

Filesize
1.6MB

Download
memory/3960-159-0x000002BFBFC00000-0x000002BFBFD96000-memory.dmp

Filesize
1.6MB

Download
memory/3960-161-0x000002BFBFC00000-0x000002BFBFD96000-memory.dmp

Filesize
1.6MB

Download
memory/3960-163-0x000002BFBFC00000-0x000002BFBFD96000-memory.dmp

Filesize
1.6MB

Download
memory/3960-165-0x000002BFBFC00000-0x000002BFBFD96000-memory.dmp

Filesize
1.6MB

Download
memory/3960-167-0x000002BFBFC00000-0x000002BFBFD96000-memory.dmp

Filesize
1.6MB

Download
memory/3960-133-0x000002BFA55D0000-0x000002BFA55E8000-memory.dmp

Filesize
96KB

Download
memory/3960-135-0x000002BFBFDD0000-0x000002BFBFDF2000-memory.dmp

Filesize
136KB

Download
memory/3960-175-0x000002BFBFC00000-0x000002BFBFD96000-memory.dmp

Filesize
1.6MB

Download
memory/3960-171-0x000002BFBFC00000-0x000002BFBFD96000-memory.dmp

Filesize
1.6MB

Download
memory/3960-177-0x000002BFBFC00000-0x000002BFBFD96000-memory.dmp

Filesize
1.6MB

Download
memory/3960-179-0x000002BFBFC00000-0x000002BFBFD96000-memory.dmp

Filesize
1.6MB

Download
memory/3960-181-0x000002BFBFC00000-0x000002BFBFD96000-memory.dmp

Filesize
1.6MB

Download
memory/3960-185-0x000002BFBFC00000-0x000002BFBFD96000-memory.dmp

Filesize
1.6MB

Download
memory/3960-189-0x000002BFBFC00000-0x000002BFBFD96000-memory.dmp

Filesize
1.6MB

Download
memory/3960-187-0x000002BFBFC00000-0x000002BFBFD96000-memory.dmp

Filesize
1.6MB

Download
memory/3960-191-0x000002BFBFC00000-0x000002BFBFD96000-memory.dmp

Filesize
1.6MB

Download
memory/3960-183-0x000002BFBFC00000-0x000002BFBFD96000-memory.dmp

Filesize
1.6MB

Download
memory/3960-193-0x000002BFBFC00000-0x000002BFBFD96000-memory.dmp

Filesize
1.6MB

Download
memory/3960-195-0x000002BFBFC00000-0x000002BFBFD96000-memory.dmp

Filesize
1.6MB

Download
memory/3960-197-0x000002BFBFC00000-0x000002BFBFD96000-memory.dmp

Filesize
1.6MB

Download
memory/3960-199-0x000002BFBFC00000-0x000002BFBFD96000-memory.dmp

Filesize
1.6MB

Download
memory/3960-569-0x000002BFA7290000-0x000002BFA72A0000-memory.dmp

Filesize
64KB

Download
memory/3960-1459-0x000002BFBFDA0000-0x000002BFBFDA1000-memory.dmp

Filesize
4KB

Download
memory/3960-134-0x000002BFA7290000-0x000002BFA72A0000-memory.dmp

Filesize
64KB

Download
memory/4676-1464-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/4676-1465-0x00000260BFC20000-0x00000260BFC30000-memory.dmp

Filesize
64KB

Download
memory/4676-2799-0x00000260BFC20000-0x00000260BFC30000-memory.dmp

Filesize
64KB

Download