127b328917d5cba521215fb9f8e0d9fe9d062913d9371272f1bf1ac12d74aa05

Analysis

max time kernel
137s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
22/10/2023, 07:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MV ADAROSE - PRE-ARRIVAL DOCS.exe
Size 529KB
Sample231022-jgeb9aeb71
SHA256 127b328917d5cba521215fb9f8e0d9fe9d062913d9371272f1bf1ac12d74aa05
MD5 bdfb3896e0da4061a08cdffef0d1932d
SHA1 a962c2fed3116b300899453938ba9f5544d3cf86
SHA512 a5ef2df132ade900974aa1ee4cb01f2da7a7ded09d36eb7a12e57375118f19581e448634c1574c5a5a7fb463865bc1961a68f4dc2e2bfca1a453ebc349f1a24d
SSDEEP 12288:r8zS55mFzSzSzBbHQWpBZ8CCaNBfMbl9YlqcWU3h3lq:rf55qDHQ08woulqF0
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3296	MV ADAROSE - PRE-ARRIVAL DOCS.exe
3296	MV ADAROSE - PRE-ARRIVAL DOCS.exe
3296	MV ADAROSE - PRE-ARRIVAL DOCS.exe
3296	MV ADAROSE - PRE-ARRIVAL DOCS.exe
3296	MV ADAROSE - PRE-ARRIVAL DOCS.exe
3296	MV ADAROSE - PRE-ARRIVAL DOCS.exe
3296	MV ADAROSE - PRE-ARRIVAL DOCS.exe
3296	MV ADAROSE - PRE-ARRIVAL DOCS.exe
3296	MV ADAROSE - PRE-ARRIVAL DOCS.exe
3296	MV ADAROSE - PRE-ARRIVAL DOCS.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3296	MV ADAROSE - PRE-ARRIVAL DOCS.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3296 wrote to memory of 4204	3296	MV ADAROSE - PRE-ARRIVAL DOCS.exe	88
PID 3296 wrote to memory of 4204	3296	MV ADAROSE - PRE-ARRIVAL DOCS.exe	88
PID 3296 wrote to memory of 4204	3296	MV ADAROSE - PRE-ARRIVAL DOCS.exe	88
PID 3296 wrote to memory of 4588	3296	MV ADAROSE - PRE-ARRIVAL DOCS.exe	89
PID 3296 wrote to memory of 4588	3296	MV ADAROSE - PRE-ARRIVAL DOCS.exe	89
PID 3296 wrote to memory of 4588	3296	MV ADAROSE - PRE-ARRIVAL DOCS.exe	89
PID 3296 wrote to memory of 1928	3296	MV ADAROSE - PRE-ARRIVAL DOCS.exe	90
PID 3296 wrote to memory of 1928	3296	MV ADAROSE - PRE-ARRIVAL DOCS.exe	90
PID 3296 wrote to memory of 1928	3296	MV ADAROSE - PRE-ARRIVAL DOCS.exe	90
PID 3296 wrote to memory of 2696	3296	MV ADAROSE - PRE-ARRIVAL DOCS.exe	92
PID 3296 wrote to memory of 2696	3296	MV ADAROSE - PRE-ARRIVAL DOCS.exe	92
PID 3296 wrote to memory of 2696	3296	MV ADAROSE - PRE-ARRIVAL DOCS.exe	92
PID 3296 wrote to memory of 4860	3296	MV ADAROSE - PRE-ARRIVAL DOCS.exe	91
PID 3296 wrote to memory of 4860	3296	MV ADAROSE - PRE-ARRIVAL DOCS.exe	91
PID 3296 wrote to memory of 4860	3296	MV ADAROSE - PRE-ARRIVAL DOCS.exe	91

C:\Users\Admin\AppData\Local\Temp\MV ADAROSE - PRE-ARRIVAL DOCS.exe
"C:\Users\Admin\AppData\Local\Temp\MV ADAROSE - PRE-ARRIVAL DOCS.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:4204
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:4588
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:1928
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:4860
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3296-0-0x0000000000A10000-0x0000000000A9A000-memory.dmp

Download

memory/3296-1-0x0000000075340000-0x0000000075AF0000-memory.dmp

Download

memory/3296-2-0x00000000058A0000-0x0000000005E44000-memory.dmp

Download

memory/3296-3-0x0000000005390000-0x0000000005422000-memory.dmp

Download

memory/3296-4-0x0000000005620000-0x0000000005630000-memory.dmp

Download

memory/3296-5-0x0000000005350000-0x000000000535A000-memory.dmp

Download

memory/3296-6-0x0000000005630000-0x00000000056CC000-memory.dmp

Download

memory/3296-7-0x0000000006EA0000-0x0000000006EB8000-memory.dmp

Download

memory/3296-8-0x0000000075340000-0x0000000075AF0000-memory.dmp

Download

memory/3296-9-0x0000000005620000-0x0000000005630000-memory.dmp

Download

memory/3296-10-0x00000000068D0000-0x00000000068E0000-memory.dmp

Download

memory/3296-11-0x0000000007060000-0x00000000070C0000-memory.dmp

Download

memory/3296-13-0x0000000075340000-0x0000000075AF0000-memory.dmp

Download