ec5a7e9539938fcb1c2feadf59afa9e864144e52aeb6a4715cc50f188c72c053 | Triage

Resubmissions

08-08-2023 17:00

230808-vjbjxsfg5y 10

08-08-2023 13:18

230808-qkbh4acf95 10

Analysis

max time kernel
120s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
08-08-2023 13:18

Sharing

Report Analysis Logs

General

Target

Income-Tax.exe
Size

529KB
MD5

8a182209d4a6fea9223298590e59bd7e
SHA1

909b60f35926c3173d36ce80127fb7792ef86402
SHA256

ec5a7e9539938fcb1c2feadf59afa9e864144e52aeb6a4715cc50f188c72c053
SHA512

425d15a1e9c9967514edaad9357182fe0ef5b392d072cf300bdf02e9927687adbc00c45b7345aae481e38dbbf4a4a3152756cb89e99a93f252c7cc740746ed38
SSDEEP

12288:TOJHqVR3f53gG46A9jmP/uhu/yMS08CkntxYR7L:68VRvWRfmP/UDMS08Ckn32

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

Income-Tax.exe

pid	Process
1080	Income-Tax.exe
1080	Income-Tax.exe
1080	Income-Tax.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Income-Tax.exe

description	pid	Process	procid_target
PID 1080 wrote to memory of 3412	1080	Income-Tax.exe	80
PID 1080 wrote to memory of 3412	1080	Income-Tax.exe	80
PID 1080 wrote to memory of 3412	1080	Income-Tax.exe	80

C:\Users\Admin\AppData\Local\Temp\Income-Tax.exe
"C:\Users\Admin\AppData\Local\Temp\Income-Tax.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:3412

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads