4157cb383c1f94ea0913993703df0ae58ed5ac01afb8ae492a989e0979ae8ad8

Analysis

max time kernel
122s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 11:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a7faf4053c734b7f2970fbec31e8139.exe
Size

295KB
MD5

6a7faf4053c734b7f2970fbec31e8139
SHA1

1edc982537b3693daffd489f91c85f483867d436
SHA256

4157cb383c1f94ea0913993703df0ae58ed5ac01afb8ae492a989e0979ae8ad8
SHA512

68d5ea13e2807e99edd036948eeee144793a918ed2306e4371805797e5aae13f5adae8f417902c08db3ffefef15e7861dfd8e5965608bf34a53fe1971b818723
SSDEEP

3072:QP8I6KZSE+FSm5CXDtpk3ilhZolF3kAXV:Q/kYo33kqV

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1040 set thread context of 1800	1040	6a7faf4053c734b7f2970fbec31e8139.exe	28
PID 1800 set thread context of 2416	1800	6a7faf4053c734b7f2970fbec31e8139.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2416	6a7faf4053c734b7f2970fbec31e8139.exe
2416	6a7faf4053c734b7f2970fbec31e8139.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1040	6a7faf4053c734b7f2970fbec31e8139.exe
1800	6a7faf4053c734b7f2970fbec31e8139.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 1800	1040	6a7faf4053c734b7f2970fbec31e8139.exe	28
PID 1040 wrote to memory of 1800	1040	6a7faf4053c734b7f2970fbec31e8139.exe	28
PID 1040 wrote to memory of 1800	1040	6a7faf4053c734b7f2970fbec31e8139.exe	28
PID 1040 wrote to memory of 1800	1040	6a7faf4053c734b7f2970fbec31e8139.exe	28
PID 1040 wrote to memory of 1800	1040	6a7faf4053c734b7f2970fbec31e8139.exe	28
PID 1040 wrote to memory of 1800	1040	6a7faf4053c734b7f2970fbec31e8139.exe	28
PID 1040 wrote to memory of 1800	1040	6a7faf4053c734b7f2970fbec31e8139.exe	28
PID 1040 wrote to memory of 1800	1040	6a7faf4053c734b7f2970fbec31e8139.exe	28
PID 1040 wrote to memory of 1800	1040	6a7faf4053c734b7f2970fbec31e8139.exe	28
PID 1800 wrote to memory of 2416	1800	6a7faf4053c734b7f2970fbec31e8139.exe	29
PID 1800 wrote to memory of 2416	1800	6a7faf4053c734b7f2970fbec31e8139.exe	29
PID 1800 wrote to memory of 2416	1800	6a7faf4053c734b7f2970fbec31e8139.exe	29
PID 1800 wrote to memory of 2416	1800	6a7faf4053c734b7f2970fbec31e8139.exe	29
PID 1800 wrote to memory of 2416	1800	6a7faf4053c734b7f2970fbec31e8139.exe	29
PID 1800 wrote to memory of 2416	1800	6a7faf4053c734b7f2970fbec31e8139.exe	29
PID 1800 wrote to memory of 2416	1800	6a7faf4053c734b7f2970fbec31e8139.exe	29
PID 1800 wrote to memory of 2416	1800	6a7faf4053c734b7f2970fbec31e8139.exe	29
PID 2416 wrote to memory of 1208	2416	6a7faf4053c734b7f2970fbec31e8139.exe	11
PID 2416 wrote to memory of 1208	2416	6a7faf4053c734b7f2970fbec31e8139.exe	11
PID 2416 wrote to memory of 1208	2416	6a7faf4053c734b7f2970fbec31e8139.exe	11
PID 2416 wrote to memory of 1208	2416	6a7faf4053c734b7f2970fbec31e8139.exe	11

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1208
- C:\Users\Admin\AppData\Local\Temp\6a7faf4053c734b7f2970fbec31e8139.exe
  "C:\Users\Admin\AppData\Local\Temp\6a7faf4053c734b7f2970fbec31e8139.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1040
- - C:\Users\Admin\AppData\Local\Temp\6a7faf4053c734b7f2970fbec31e8139.exe
    C:\Users\Admin\AppData\Local\Temp\6a7faf4053c734b7f2970fbec31e8139.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1800
  - - C:\Users\Admin\AppData\Local\Temp\6a7faf4053c734b7f2970fbec31e8139.exe
      "C:\Users\Admin\AppData\Local\Temp\6a7faf4053c734b7f2970fbec31e8139.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2416

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1208-23-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1208-27-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/1800-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1800-4-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1800-7-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1800-19-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2416-16-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2416-21-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2416-22-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2416-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2416-11-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2416-9-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2416-26-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2416-18-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2416-13-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download