Analysis

  • max time kernel
    145s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-10-2023 17:33

General

  • Target

    4952979661b152d02da944a47e29c1dd7407d8039ca4577a9578e081b19e8f78.exe

  • Size

    322KB

  • MD5

    ac7ec5342b95f9b4a70a23c9c0774443

  • SHA1

    9feece16a385a7dd5bf3a096693e5cfea1d243e2

  • SHA256

    4952979661b152d02da944a47e29c1dd7407d8039ca4577a9578e081b19e8f78

  • SHA512

    0472f1a3c6cf4fd23bf06ad2c8e47ecb6ae6ae052cdd8a485f7396865005123a9c8eaa983a62c7cbf947c1a5dfc627665e2218b785c7f7ddfe4537d798bd031b

  • SSDEEP

    6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4952979661b152d02da944a47e29c1dd7407d8039ca4577a9578e081b19e8f78.exe
    "C:\Users\Admin\AppData\Local\Temp\4952979661b152d02da944a47e29c1dd7407d8039ca4577a9578e081b19e8f78.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2868
    • C:\Users\Admin\AppData\Local\Temp\4952979661b152d02da944a47e29c1dd7407d8039ca4577a9578e081b19e8f78.exe
      C:\Users\Admin\AppData\Local\Temp\4952979661b152d02da944a47e29c1dd7407d8039ca4577a9578e081b19e8f78.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2264
      • C:\Windows\SysWOW64\schtasks.exe
        /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
        3⤵
        • Creates scheduled task(s)
        PID:2336

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2264-9-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/2264-13-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/2264-11-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/2868-3-0x00000000080C0000-0x0000000008664000-memory.dmp

    Filesize

    5.6MB

  • memory/2868-4-0x0000000007BB0000-0x0000000007C42000-memory.dmp

    Filesize

    584KB

  • memory/2868-5-0x0000000002E80000-0x0000000002E86000-memory.dmp

    Filesize

    24KB

  • memory/2868-6-0x0000000005540000-0x0000000005550000-memory.dmp

    Filesize

    64KB

  • memory/2868-7-0x0000000006A70000-0x0000000006AE6000-memory.dmp

    Filesize

    472KB

  • memory/2868-8-0x0000000006A40000-0x0000000006A5E000-memory.dmp

    Filesize

    120KB

  • memory/2868-0-0x0000000000D00000-0x0000000000D56000-memory.dmp

    Filesize

    344KB

  • memory/2868-2-0x0000000007A40000-0x0000000007B0C000-memory.dmp

    Filesize

    816KB

  • memory/2868-1-0x0000000074CE0000-0x0000000075490000-memory.dmp

    Filesize

    7.7MB

  • memory/2868-15-0x0000000074CE0000-0x0000000075490000-memory.dmp

    Filesize

    7.7MB