7441f58afc873195fc479a9b253fbb1ce896783936fa3ca9cfa16b087a9a9be2

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 08:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

60618a6382bb5129ceb7f7aa4431e2b7.exe
Size

548KB
MD5

60618a6382bb5129ceb7f7aa4431e2b7
SHA1

66fc895ae8e107241042532b467bf54a5ad810d3
SHA256

7441f58afc873195fc479a9b253fbb1ce896783936fa3ca9cfa16b087a9a9be2
SHA512

832aaa45f4b87e8e2bd8fb61d597a46ef5368b79c20034c3ad89ebc537eab549c30342fa52da1c535f7e24e2f9a87f4c7cf9ca2847763688bc1dd86b732efec0
SSDEEP

12288:Ymczlwp05f2Mfjp3bPU/4yK/lGRgOUqmq9kR6lhKXxh+LqmXFLfIw5:Ymolwp05LjiK/cRgOnmq9g6C+zpr5

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2100 set thread context of 1604	2100	60618a6382bb5129ceb7f7aa4431e2b7.exe	16

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1604	60618a6382bb5129ceb7f7aa4431e2b7.exe
1604	60618a6382bb5129ceb7f7aa4431e2b7.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2100	60618a6382bb5129ceb7f7aa4431e2b7.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 1604	2100	60618a6382bb5129ceb7f7aa4431e2b7.exe	16
PID 2100 wrote to memory of 1604	2100	60618a6382bb5129ceb7f7aa4431e2b7.exe	16
PID 2100 wrote to memory of 1604	2100	60618a6382bb5129ceb7f7aa4431e2b7.exe	16
PID 2100 wrote to memory of 1604	2100	60618a6382bb5129ceb7f7aa4431e2b7.exe	16
PID 2100 wrote to memory of 1604	2100	60618a6382bb5129ceb7f7aa4431e2b7.exe	16
PID 2100 wrote to memory of 1604	2100	60618a6382bb5129ceb7f7aa4431e2b7.exe	16
PID 2100 wrote to memory of 1604	2100	60618a6382bb5129ceb7f7aa4431e2b7.exe	16
PID 2100 wrote to memory of 1604	2100	60618a6382bb5129ceb7f7aa4431e2b7.exe	16
PID 1604 wrote to memory of 1220	1604	60618a6382bb5129ceb7f7aa4431e2b7.exe	6
PID 1604 wrote to memory of 1220	1604	60618a6382bb5129ceb7f7aa4431e2b7.exe	6
PID 1604 wrote to memory of 1220	1604	60618a6382bb5129ceb7f7aa4431e2b7.exe	6
PID 1604 wrote to memory of 1220	1604	60618a6382bb5129ceb7f7aa4431e2b7.exe	6

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1220
- C:\Users\Admin\AppData\Local\Temp\60618a6382bb5129ceb7f7aa4431e2b7.exe
  "C:\Users\Admin\AppData\Local\Temp\60618a6382bb5129ceb7f7aa4431e2b7.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2100
- - C:\Users\Admin\AppData\Local\Temp\60618a6382bb5129ceb7f7aa4431e2b7.exe
    C:\Users\Admin\AppData\Local\Temp\60618a6382bb5129ceb7f7aa4431e2b7.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1220-33-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/1220-29-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1604-19-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1604-26-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/1604-16-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1604-32-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1604-27-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2100-12-0x0000000003160000-0x0000000003260000-memory.dmp

Filesize
1024KB

Download
memory/2100-6-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/2100-25-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2100-24-0x00000000005D0000-0x0000000000630000-memory.dmp

Filesize
384KB

Download
memory/2100-23-0x0000000003160000-0x0000000003260000-memory.dmp

Filesize
1024KB

Download
memory/2100-21-0x0000000003160000-0x0000000003260000-memory.dmp

Filesize
1024KB

Download
memory/2100-14-0x0000000003160000-0x0000000003260000-memory.dmp

Filesize
1024KB

Download
memory/2100-13-0x0000000003160000-0x0000000003260000-memory.dmp

Filesize
1024KB

Download
memory/2100-7-0x0000000001E80000-0x0000000001E81000-memory.dmp

Filesize
4KB

Download
memory/2100-20-0x0000000003160000-0x0000000003260000-memory.dmp

Filesize
1024KB

Download
memory/2100-10-0x0000000003160000-0x0000000003260000-memory.dmp

Filesize
1024KB

Download
memory/2100-22-0x0000000000400000-0x00000000004FC000-memory.dmp

Filesize
1008KB

Download
memory/2100-5-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/2100-4-0x0000000001E70000-0x0000000001E71000-memory.dmp

Filesize
4KB

Download
memory/2100-3-0x0000000000580000-0x0000000000581000-memory.dmp

Filesize
4KB

Download
memory/2100-2-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/2100-1-0x00000000005D0000-0x0000000000630000-memory.dmp

Filesize
384KB

Download
memory/2100-0-0x0000000000400000-0x00000000004FC000-memory.dmp

Filesize
1008KB

Download
memory/2100-18-0x0000000003160000-0x0000000003260000-memory.dmp

Filesize
1024KB

Download
memory/2100-15-0x0000000003160000-0x0000000003260000-memory.dmp

Filesize
1024KB

Download
memory/2100-8-0x0000000003160000-0x0000000003260000-memory.dmp

Filesize
1024KB

Download
memory/2100-44-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download