Analysis

  • max time kernel
    120s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2023, 18:58

General

  • Target

    rOrderRequirements-Invoice.exe

  • Size

    806KB

  • MD5

    aa79e4458fd7f7be6b044281984dc3cf

  • SHA1

    4fa6041b430c958e4c403c3f140783cf1ad05c79

  • SHA256

    716cc459f4685123823a8e5fc94768b3526c0900c98a0e51c5ce4b794b6b9f8c

  • SHA512

    a9dbe8065515bf06455179cf8c965d94d0f7f7ad83c82f84807e526cea8b07798bc5543b184f609f48290b4784f114f3f8a1b416ff6a977d097f2e3d202def2a

  • SSDEEP

    24576:IyFdolEMsxb+zqFPoBmjvZIKiUnmOU5uQn:IGYEMsxb+zqJemjvFmOk

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe
    "C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2636
    • C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe
      "C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe"
      2⤵
        PID:2624
      • C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe
        "C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe"
        2⤵
          PID:2668
        • C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe
          "C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe"
          2⤵
            PID:2540
          • C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe
            "C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe"
            2⤵
              PID:2684
            • C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe
              "C:\Users\Admin\AppData\Local\Temp\rOrderRequirements-Invoice.exe"
              2⤵
                PID:2528

            Network

                  MITRE ATT&CK Matrix

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • memory/2636-0-0x00000000003C0000-0x0000000000490000-memory.dmp

                    Filesize

                    832KB

                  • memory/2636-1-0x0000000074AC0000-0x00000000751AE000-memory.dmp

                    Filesize

                    6.9MB

                  • memory/2636-2-0x0000000007370000-0x00000000073B0000-memory.dmp

                    Filesize

                    256KB

                  • memory/2636-3-0x0000000000350000-0x0000000000360000-memory.dmp

                    Filesize

                    64KB

                  • memory/2636-4-0x0000000074AC0000-0x00000000751AE000-memory.dmp

                    Filesize

                    6.9MB

                  • memory/2636-5-0x0000000007370000-0x00000000073B0000-memory.dmp

                    Filesize

                    256KB

                  • memory/2636-6-0x0000000000530000-0x000000000053C000-memory.dmp

                    Filesize

                    48KB

                  • memory/2636-7-0x0000000004AC0000-0x0000000004B2E000-memory.dmp

                    Filesize

                    440KB

                  • memory/2636-8-0x0000000074AC0000-0x00000000751AE000-memory.dmp

                    Filesize

                    6.9MB