Analysis
- max time kernel
37s - max time network
42s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
30/12/2023, 10:16
General
- Target 159b916c82fe345993903613e6b40054.exe
- Size 370KB
- Sample231230-ma3m2sfgap
- SHA256 39e4c54fe28dea9c2ccd065e950362e06884218f3367650e639e7d5ca59d46d3
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\159b916c82fe345993903613e6b40054.exe"C:\Users\Admin\AppData\Local\Temp\159b916c82fe345993903613e6b40054.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/372-11-0x0000000000400000-0x0000000000404A00-memory.dmp
memory/372-1-0x00000000005E0000-0x00000000005E2000-memory.dmp
memory/372-2-0x0000000000400000-0x0000000000405000-memory.dmp
memory/372-3-0x0000000002520000-0x0000000002F20000-memory.dmp
memory/372-0-0x0000000000400000-0x000000000046D000-memory.dmp
memory/372-12-0x0000000002520000-0x0000000002F20000-memory.dmp
memory/2448-14-0x0000000000C00000-0x0000000000C07000-memory.dmp
memory/2728-21-0x0000000000A70000-0x0000000000A77000-memory.dmp
memory/2964-5-0x0000000002A80000-0x0000000002A87000-memory.dmp
memory/2964-7-0x00000000776C2000-0x00000000776C3000-memory.dmp
memory/2964-8-0x0000000002A80000-0x0000000002A87000-memory.dmp
memory/3304-9-0x00007FF82DCED000-0x00007FF82DCEE000-memory.dmp
memory/3304-4-0x0000000000D10000-0x0000000000D17000-memory.dmp
memory/3304-6-0x0000000000D10000-0x0000000000D17000-memory.dmp
memory/3604-19-0x0000000000C00000-0x0000000000C07000-memory.dmp