53e891f9b9098e2f7f29c3129ff55d16faa213ac9d07efbb5443d0d42809adf2

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2023, 13:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CAMSCANNER-2023.07.11.exe
Size

85KB
MD5

1c2d00ad527ad7a0d3165c78e6a42cdf
SHA1

366de59ddda44aef246e4e61a06682af15852214
SHA256

53e891f9b9098e2f7f29c3129ff55d16faa213ac9d07efbb5443d0d42809adf2
SHA512

1cf42328be4f664928cbba298b95b4245a13c0e805457fe88932872d560abb0937f0d6e0f49bb65670d26d59546a0890c19a00ab668516378fbea4d9e7e1bc36
SSDEEP

1536:sTdw6Mf5lpZBYkDkhEzF3sydyc4F9nY++cuq/x8ir0ct41qyfZbdTsUXU8wU2gud:QdFS5lKStmFpJJ/xvr0cSPTdYNj11z

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Onlyxwfsz = "C:\\Users\\Admin\\AppData\\Roaming\\Onlyxwfsz.exe"	CAMSCANNER-2023.07.11.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4500 set thread context of 1828	4500	CAMSCANNER-2023.07.11.exe	92

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4500	CAMSCANNER-2023.07.11.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 1828	4500	CAMSCANNER-2023.07.11.exe	92
PID 4500 wrote to memory of 1828	4500	CAMSCANNER-2023.07.11.exe	92
PID 4500 wrote to memory of 1828	4500	CAMSCANNER-2023.07.11.exe	92
PID 4500 wrote to memory of 1828	4500	CAMSCANNER-2023.07.11.exe	92
PID 4500 wrote to memory of 1828	4500	CAMSCANNER-2023.07.11.exe	92
PID 4500 wrote to memory of 1828	4500	CAMSCANNER-2023.07.11.exe	92

C:\Users\Admin\AppData\Local\Temp\CAMSCANNER-2023.07.11.exe
"C:\Users\Admin\AppData\Local\Temp\CAMSCANNER-2023.07.11.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Users\Admin\AppData\Local\Temp\CAMSCANNER-2023.07.11.exe
  C:\Users\Admin\AppData\Local\Temp\CAMSCANNER-2023.07.11.exe
  2⤵
  PID:1828

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\CAMSCANNER-2023.07.11.exe.log

Filesize
1KB

MD5
837f5f89a32c72306ecb0f0a1562d4ba

SHA1
e487a7dbf251e45764dd4f0ff86a5fc1492ca18c

SHA256
f9b02cf723902238ddf66a70ef30edbe70d738b308800a97a6c0bef3ed7e41fe

SHA512
0bc7dfd358456e643e886bd110c7c7c1f58dcf4863169a3f186dc7e8a2a3f437000fdc311dbd2cfde571118076bef3f16ba01191e0e3220011b9fd80a155148a

Download Submit
memory/1828-3610-0x0000021E45060000-0x0000021E45070000-memory.dmp

Filesize
64KB

Download
memory/1828-1594-0x0000021E45060000-0x0000021E45070000-memory.dmp

Filesize
64KB

Download
memory/1828-1464-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/4500-169-0x0000019B6DAB0000-0x0000019B6DC46000-memory.dmp

Filesize
1.6MB

Download
memory/4500-175-0x0000019B6DAB0000-0x0000019B6DC46000-memory.dmp

Filesize
1.6MB

Download
memory/4500-141-0x0000019B6DAB0000-0x0000019B6DC46000-memory.dmp

Filesize
1.6MB

Download
memory/4500-143-0x0000019B6DAB0000-0x0000019B6DC46000-memory.dmp

Filesize
1.6MB

Download
memory/4500-145-0x0000019B6DAB0000-0x0000019B6DC46000-memory.dmp

Filesize
1.6MB

Download
memory/4500-147-0x0000019B6DAB0000-0x0000019B6DC46000-memory.dmp

Filesize
1.6MB

Download
memory/4500-149-0x0000019B6DAB0000-0x0000019B6DC46000-memory.dmp

Filesize
1.6MB

Download
memory/4500-151-0x0000019B6DAB0000-0x0000019B6DC46000-memory.dmp

Filesize
1.6MB

Download
memory/4500-153-0x0000019B6DAB0000-0x0000019B6DC46000-memory.dmp

Filesize
1.6MB

Download
memory/4500-177-0x0000019B6DAB0000-0x0000019B6DC46000-memory.dmp

Filesize
1.6MB

Download
memory/4500-157-0x0000019B6DAB0000-0x0000019B6DC46000-memory.dmp

Filesize
1.6MB

Download
memory/4500-159-0x0000019B6DAB0000-0x0000019B6DC46000-memory.dmp

Filesize
1.6MB

Download
memory/4500-161-0x0000019B6DAB0000-0x0000019B6DC46000-memory.dmp

Filesize
1.6MB

Download
memory/4500-163-0x0000019B6DAB0000-0x0000019B6DC46000-memory.dmp

Filesize
1.6MB

Download
memory/4500-165-0x0000019B6DAB0000-0x0000019B6DC46000-memory.dmp

Filesize
1.6MB

Download
memory/4500-167-0x0000019B6DAB0000-0x0000019B6DC46000-memory.dmp

Filesize
1.6MB

Download
memory/4500-133-0x0000019B6B390000-0x0000019B6B3A8000-memory.dmp

Filesize
96KB

Download
memory/4500-171-0x0000019B6DAB0000-0x0000019B6DC46000-memory.dmp

Filesize
1.6MB

Download
memory/4500-139-0x0000019B6DAB0000-0x0000019B6DC46000-memory.dmp

Filesize
1.6MB

Download
memory/4500-173-0x0000019B6DAB0000-0x0000019B6DC46000-memory.dmp

Filesize
1.6MB

Download
memory/4500-155-0x0000019B6DAB0000-0x0000019B6DC46000-memory.dmp

Filesize
1.6MB

Download
memory/4500-179-0x0000019B6DAB0000-0x0000019B6DC46000-memory.dmp

Filesize
1.6MB

Download
memory/4500-181-0x0000019B6DAB0000-0x0000019B6DC46000-memory.dmp

Filesize
1.6MB

Download
memory/4500-183-0x0000019B6DAB0000-0x0000019B6DC46000-memory.dmp

Filesize
1.6MB

Download
memory/4500-185-0x0000019B6DAB0000-0x0000019B6DC46000-memory.dmp

Filesize
1.6MB

Download
memory/4500-187-0x0000019B6DAB0000-0x0000019B6DC46000-memory.dmp

Filesize
1.6MB

Download
memory/4500-189-0x0000019B6DAB0000-0x0000019B6DC46000-memory.dmp

Filesize
1.6MB

Download
memory/4500-191-0x0000019B6DAB0000-0x0000019B6DC46000-memory.dmp

Filesize
1.6MB

Download
memory/4500-193-0x0000019B6DAB0000-0x0000019B6DC46000-memory.dmp

Filesize
1.6MB

Download
memory/4500-195-0x0000019B6DAB0000-0x0000019B6DC46000-memory.dmp

Filesize
1.6MB

Download
memory/4500-197-0x0000019B6DAB0000-0x0000019B6DC46000-memory.dmp

Filesize
1.6MB

Download
memory/4500-199-0x0000019B6DAB0000-0x0000019B6DC46000-memory.dmp

Filesize
1.6MB

Download
memory/4500-695-0x0000019B6D9A0000-0x0000019B6D9B0000-memory.dmp

Filesize
64KB

Download
memory/4500-1459-0x0000019B6B7E0000-0x0000019B6B7E1000-memory.dmp

Filesize
4KB

Download
memory/4500-137-0x0000019B6DAB0000-0x0000019B6DC46000-memory.dmp

Filesize
1.6MB

Download
memory/4500-136-0x0000019B6DAB0000-0x0000019B6DC46000-memory.dmp

Filesize
1.6MB

Download
memory/4500-135-0x0000019B6B840000-0x0000019B6B862000-memory.dmp

Filesize
136KB

Download
memory/4500-134-0x0000019B6D9A0000-0x0000019B6D9B0000-memory.dmp

Filesize
64KB

Download