Analysis

  • max time kernel
    111s
  • max time network
    30s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    04/01/2024, 01:08

General

  • Target

    3f8375d365a92a2241855a5027e8e7c1.exe

  • Size

    282KB

  • MD5

    3f8375d365a92a2241855a5027e8e7c1

  • SHA1

    63b8238cb0d22ce37f85fb6b8b7648e4a29c65a9

  • SHA256

    02a29d49a2c5c9759bc2c98b2bc782c641f002c7b26fff35e247acbe4b7a244c

  • SHA512

    e91c6312b279b533283b972ee8d77fb8f9357f1a12b57d90d5a3fa2d3ea84690c359c1f0965417a97c9a075b48f855b5722a86a760943c6e49de4632a478fbad

  • SSDEEP

    6144:ozppykBHHZ1ILn3/fqpeq6u/tv6tB6vdu8xIKLazQ:ozyQ1ILPfi0ud4B6vduCIKLa8

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3f8375d365a92a2241855a5027e8e7c1.exe
    "C:\Users\Admin\AppData\Local\Temp\3f8375d365a92a2241855a5027e8e7c1.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2580
    • C:\Users\Admin\AppData\Local\Temp\3f8375d365a92a2241855a5027e8e7c1.exe
      C:\Users\Admin\AppData\Local\Temp\3f8375d365a92a2241855a5027e8e7c1.exe
      2⤵
        PID:1736

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1736-5-0x0000000000400000-0x0000000000418000-memory.dmp

      Filesize

      96KB

    • memory/1736-7-0x0000000000400000-0x0000000000418000-memory.dmp

      Filesize

      96KB

    • memory/1736-9-0x0000000000400000-0x0000000000418000-memory.dmp

      Filesize

      96KB

    • memory/1736-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/1736-13-0x0000000000400000-0x0000000000418000-memory.dmp

      Filesize

      96KB

    • memory/2580-0-0x0000000074B10000-0x00000000750BB000-memory.dmp

      Filesize

      5.7MB

    • memory/2580-1-0x0000000074B10000-0x00000000750BB000-memory.dmp

      Filesize

      5.7MB

    • memory/2580-2-0x00000000001F0000-0x0000000000230000-memory.dmp

      Filesize

      256KB

    • memory/2580-3-0x0000000074B10000-0x00000000750BB000-memory.dmp

      Filesize

      5.7MB

    • memory/2580-4-0x00000000001F0000-0x0000000000230000-memory.dmp

      Filesize

      256KB

    • memory/2580-15-0x0000000074B10000-0x00000000750BB000-memory.dmp

      Filesize

      5.7MB