29576f96e3d0e8ff09b652b1f0b6a3e9ae01fdd64f9a987142155a8ff59044ce

Analysis

max time kernel
147s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 07:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

rosetvsetup.exe
Size

1.5MB
MD5

39d5dc8551cc18d7e97e1721de6efea0
SHA1

3d5db46d3a4a5623d94eb868730a7e8f8b9ee8a3
SHA256

1289366c3281deea660f18bc60def1591636efd1d39f3bd1bc5a7284cd4e1e5f
SHA512

a184c3e5c1d8c7f74075996572152aa506c5e49e0c41a4bebaff3bdf4eae1984f935202914624a43de26a7e2636007a9988e9f819861e486c6bf4c284f6bf4db
SSDEEP

24576:1fOy6W4PkUvwf9bD8lxxhvT00cEpnfYMWSXmuyEh0a7GSPDAaJ1Bkf1nC0l803Hf:1Gpl4f9AhvT00RVYMWbFaAaJ1mblvHf

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3360	is-AMFF5.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 3360	1264	rosetvsetup.exe	18
PID 1264 wrote to memory of 3360	1264	rosetvsetup.exe	18
PID 1264 wrote to memory of 3360	1264	rosetvsetup.exe	18

C:\Users\Admin\AppData\Local\Temp\rosetvsetup.exe
"C:\Users\Admin\AppData\Local\Temp\rosetvsetup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Users\Admin\AppData\Local\Temp\is-QVR6M.tmp\is-AMFF5.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-QVR6M.tmp\is-AMFF5.tmp" /SL4 $40220 "C:\Users\Admin\AppData\Local\Temp\rosetvsetup.exe" 1308203 50688
  2⤵
  - Executes dropped EXE
  PID:3360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1264-2-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1264-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1264-13-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/3360-7-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/3360-14-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/3360-17-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download