Analysis

  • max time kernel
    122s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    15-07-2023 13:40

General

  • Target

    VmManagedSetup.exe

  • Size

    13KB

  • MD5

    383a80304cc43365619d7e20b9d54d56

  • SHA1

    299894d56be26ca9304927848951235c61322fef

  • SHA256

    2f90da6517ba31d42cd907480ded408e711761fb727c89baef821e040485365a

  • SHA512

    2d8442c6863b0dd733e6adebe5ff16b8e5e33446b2313e1e8077cd10ae94c5b1ed95a890ba7025fc2872e8a5c0de65f860a0a89cd71b6d6e0131289220437561

  • SSDEEP

    192:TJCWT9Z1evE5DW/npyaPa3X4HTyT8Lem1mu9yaHOkrUNlM:T5T9Z0vV/nQaWoH+T8qc59ywrUN

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\VmManagedSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\VmManagedSetup.exe"
    1⤵
    • Drops file in Windows directory
    PID:2448
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {1A61AFA7-BE92-4B3A-AD5F-F6975510B8DA} S-1-5-18:NT AUTHORITY\System:Service:
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2896
    • C:\Users\Admin\AppData\Local\Temp\VmManagedSetup.exe
      C:\Users\Admin\AppData\Local\Temp\VmManagedSetup.exe start
      2⤵
        PID:1928

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads