8162b6759eae7bebade19b3e7a0f0a208546675189c7e79c26dddfc258c5c653

Analysis

max time kernel
117s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2023, 05:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b2f1ba65b5e4d49ff785247fc553bd94.exe
Size

1.1MB
MD5

b2f1ba65b5e4d49ff785247fc553bd94
SHA1

95c954ddd69078b6bb4548b0f47b111696ccf54b
SHA256

8162b6759eae7bebade19b3e7a0f0a208546675189c7e79c26dddfc258c5c653
SHA512

656679398e6db8da3e8647c3a7e526b2c03d88a33fdaf2dcd8dc99c2c43a744e37a43cc6f2a7851508e74f4a09b28ffe5b2ee45cda6aa2014ef816257d86e933
SSDEEP

24576:qdNNhBQtDVSZgoc30ktNJWJuwcRdx1OBXg9/Dh8R39VYPkrj:uk330ktN4uwgdx1OdkLiR39VKkf

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5072 set thread context of 3304	5072	b2f1ba65b5e4d49ff785247fc553bd94.exe	89

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
5072	b2f1ba65b5e4d49ff785247fc553bd94.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5072	b2f1ba65b5e4d49ff785247fc553bd94.exe
Token: SeDebugPrivilege	3304	MSBuild.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 3304	5072	b2f1ba65b5e4d49ff785247fc553bd94.exe	89
PID 5072 wrote to memory of 3304	5072	b2f1ba65b5e4d49ff785247fc553bd94.exe	89
PID 5072 wrote to memory of 3304	5072	b2f1ba65b5e4d49ff785247fc553bd94.exe	89
PID 5072 wrote to memory of 3304	5072	b2f1ba65b5e4d49ff785247fc553bd94.exe	89
PID 5072 wrote to memory of 3304	5072	b2f1ba65b5e4d49ff785247fc553bd94.exe	89
PID 5072 wrote to memory of 3304	5072	b2f1ba65b5e4d49ff785247fc553bd94.exe	89

C:\Users\Admin\AppData\Local\Temp\b2f1ba65b5e4d49ff785247fc553bd94.exe
"C:\Users\Admin\AppData\Local\Temp\b2f1ba65b5e4d49ff785247fc553bd94.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3304-1085-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3304-1089-0x00007FFBEBED0000-0x00007FFBEC991000-memory.dmp

Filesize
10.8MB

Download
memory/3304-1088-0x000002445E540000-0x000002445E550000-memory.dmp

Filesize
64KB

Download
memory/3304-1087-0x00007FFBEBED0000-0x00007FFBEC991000-memory.dmp

Filesize
10.8MB

Download
memory/5072-40-0x0000020F3AF10000-0x0000020F3B061000-memory.dmp

Filesize
1.3MB

Download
memory/5072-46-0x0000020F3AF10000-0x0000020F3B061000-memory.dmp

Filesize
1.3MB

Download
memory/5072-8-0x0000020F3AF10000-0x0000020F3B061000-memory.dmp

Filesize
1.3MB

Download
memory/5072-10-0x0000020F3AF10000-0x0000020F3B061000-memory.dmp

Filesize
1.3MB

Download
memory/5072-12-0x0000020F3AF10000-0x0000020F3B061000-memory.dmp

Filesize
1.3MB

Download
memory/5072-14-0x0000020F3AF10000-0x0000020F3B061000-memory.dmp

Filesize
1.3MB

Download
memory/5072-16-0x0000020F3AF10000-0x0000020F3B061000-memory.dmp

Filesize
1.3MB

Download
memory/5072-18-0x0000020F3AF10000-0x0000020F3B061000-memory.dmp

Filesize
1.3MB

Download
memory/5072-20-0x0000020F3AF10000-0x0000020F3B061000-memory.dmp

Filesize
1.3MB

Download
memory/5072-22-0x0000020F3AF10000-0x0000020F3B061000-memory.dmp

Filesize
1.3MB

Download
memory/5072-24-0x0000020F3AF10000-0x0000020F3B061000-memory.dmp

Filesize
1.3MB

Download
memory/5072-26-0x0000020F3AF10000-0x0000020F3B061000-memory.dmp

Filesize
1.3MB

Download
memory/5072-28-0x0000020F3AF10000-0x0000020F3B061000-memory.dmp

Filesize
1.3MB

Download
memory/5072-30-0x0000020F3AF10000-0x0000020F3B061000-memory.dmp

Filesize
1.3MB

Download
memory/5072-32-0x0000020F3AF10000-0x0000020F3B061000-memory.dmp

Filesize
1.3MB

Download
memory/5072-34-0x0000020F3AF10000-0x0000020F3B061000-memory.dmp

Filesize
1.3MB

Download
memory/5072-36-0x0000020F3AF10000-0x0000020F3B061000-memory.dmp

Filesize
1.3MB

Download
memory/5072-38-0x0000020F3AF10000-0x0000020F3B061000-memory.dmp

Filesize
1.3MB

Download
memory/5072-0-0x0000020F1E6C0000-0x0000020F1E7D4000-memory.dmp

Filesize
1.1MB

Download
memory/5072-42-0x0000020F3AF10000-0x0000020F3B061000-memory.dmp

Filesize
1.3MB

Download
memory/5072-6-0x0000020F3AF10000-0x0000020F3B061000-memory.dmp

Filesize
1.3MB

Download
memory/5072-48-0x0000020F3AF10000-0x0000020F3B061000-memory.dmp

Filesize
1.3MB

Download
memory/5072-44-0x0000020F3AF10000-0x0000020F3B061000-memory.dmp

Filesize
1.3MB

Download
memory/5072-50-0x0000020F3AF10000-0x0000020F3B061000-memory.dmp

Filesize
1.3MB

Download
memory/5072-54-0x0000020F3AF10000-0x0000020F3B061000-memory.dmp

Filesize
1.3MB

Download
memory/5072-52-0x0000020F3AF10000-0x0000020F3B061000-memory.dmp

Filesize
1.3MB

Download
memory/5072-56-0x0000020F3AF10000-0x0000020F3B061000-memory.dmp

Filesize
1.3MB

Download
memory/5072-58-0x0000020F3AF10000-0x0000020F3B061000-memory.dmp

Filesize
1.3MB

Download
memory/5072-60-0x0000020F3AF10000-0x0000020F3B061000-memory.dmp

Filesize
1.3MB

Download
memory/5072-62-0x0000020F3AF10000-0x0000020F3B061000-memory.dmp

Filesize
1.3MB

Download
memory/5072-64-0x0000020F3AF10000-0x0000020F3B061000-memory.dmp

Filesize
1.3MB

Download
memory/5072-66-0x0000020F3AF10000-0x0000020F3B061000-memory.dmp

Filesize
1.3MB

Download
memory/5072-526-0x00007FFBEBED0000-0x00007FFBEC991000-memory.dmp

Filesize
10.8MB

Download
memory/5072-613-0x0000020F20550000-0x0000020F20560000-memory.dmp

Filesize
64KB

Download
memory/5072-1081-0x0000020F38DB0000-0x0000020F38DB1000-memory.dmp

Filesize
4KB

Download
memory/5072-1082-0x0000020F20550000-0x0000020F20560000-memory.dmp

Filesize
64KB

Download
memory/5072-3-0x0000020F3AF10000-0x0000020F3B061000-memory.dmp

Filesize
1.3MB

Download
memory/5072-4-0x0000020F3AF10000-0x0000020F3B061000-memory.dmp

Filesize
1.3MB

Download
memory/5072-1086-0x00007FFBEBED0000-0x00007FFBEC991000-memory.dmp

Filesize
10.8MB

Download
memory/5072-2-0x0000020F20550000-0x0000020F20560000-memory.dmp

Filesize
64KB

Download
memory/5072-1-0x00007FFBEBED0000-0x00007FFBEC991000-memory.dmp

Filesize
10.8MB

Download