f019e0823fd6b225d4665fd9f07eb6c711c245b6f3497c27773dd4aa8cdc82e7

Analysis

max time kernel
49s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2024, 08:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Enquiry.exe
Size

898KB
MD5

d4ab2082f217f9e476b90ae6c4cda32b
SHA1

1d3f6bac27179b7edb2fa2ac65c92225e29b2008
SHA256

8e21b25da6d1e6d4105e3099fbef0c3fc7d880bb79ed3a09b5b7361255475955
SHA512

506dcecb01f3b8c034fbdffc4e469acd190919f2cbc143315ae358bdffe4fe6e9a03d17da9ba8f79e16e142e678351d6491cf52dd91f27290267cad33dc2aa1e
SSDEEP

12288:FNzWcHK7zYheEqnwdS7hc6rYjN9MWjUn+/xv3dmSVh/vI0YkDKwLDN9ueQSlEEPK:rzmXEN6U7Bv34SPvyKKih9SqKe

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2776 set thread context of 2996	2776	Enquiry.exe	107

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2996	Enquiry.exe
2996	Enquiry.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2996	Enquiry.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2996	2776	Enquiry.exe	107
PID 2776 wrote to memory of 2996	2776	Enquiry.exe	107
PID 2776 wrote to memory of 2996	2776	Enquiry.exe	107
PID 2776 wrote to memory of 2996	2776	Enquiry.exe	107
PID 2776 wrote to memory of 2996	2776	Enquiry.exe	107
PID 2776 wrote to memory of 2996	2776	Enquiry.exe	107
PID 2776 wrote to memory of 2996	2776	Enquiry.exe	107
PID 2776 wrote to memory of 2996	2776	Enquiry.exe	107

C:\Users\Admin\AppData\Local\Temp\Enquiry.exe
"C:\Users\Admin\AppData\Local\Temp\Enquiry.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Users\Admin\AppData\Local\Temp\Enquiry.exe
  "C:\Users\Admin\AppData\Local\Temp\Enquiry.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2776-10-0x0000000006810000-0x00000000068CA000-memory.dmp

Filesize
744KB

Download
memory/2776-11-0x0000000008E80000-0x0000000008EFA000-memory.dmp

Filesize
488KB

Download
memory/2776-3-0x0000000005260000-0x0000000005804000-memory.dmp

Filesize
5.6MB

Download
memory/2776-4-0x0000000004CB0000-0x0000000004D42000-memory.dmp

Filesize
584KB

Download
memory/2776-0-0x00000000000E0000-0x00000000001C6000-memory.dmp

Filesize
920KB

Download
memory/2776-5-0x0000000004E60000-0x0000000004E70000-memory.dmp

Filesize
64KB

Download
memory/2776-7-0x0000000004ED0000-0x0000000004F26000-memory.dmp

Filesize
344KB

Download
memory/2776-6-0x0000000004BC0000-0x0000000004BCA000-memory.dmp

Filesize
40KB

Download
memory/2776-8-0x0000000006680000-0x0000000006696000-memory.dmp

Filesize
88KB

Download
memory/2776-15-0x00000000746D0000-0x0000000074E80000-memory.dmp

Filesize
7.7MB

Download
memory/2776-2-0x0000000004C10000-0x0000000004CAC000-memory.dmp

Filesize
624KB

Download
memory/2776-1-0x00000000746D0000-0x0000000074E80000-memory.dmp

Filesize
7.7MB

Download
memory/2776-9-0x00000000746D0000-0x0000000074E80000-memory.dmp

Filesize
7.7MB

Download
memory/2996-16-0x00000000746D0000-0x0000000074E80000-memory.dmp

Filesize
7.7MB

Download
memory/2996-17-0x0000000005B00000-0x0000000005B10000-memory.dmp

Filesize
64KB

Download
memory/2996-12-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2996-19-0x0000000006860000-0x00000000068C6000-memory.dmp

Filesize
408KB

Download
memory/2996-18-0x0000000005AE0000-0x0000000005AF8000-memory.dmp

Filesize
96KB

Download
memory/2996-21-0x00000000746D0000-0x0000000074E80000-memory.dmp

Filesize
7.7MB

Download
memory/2996-22-0x0000000005B00000-0x0000000005B10000-memory.dmp

Filesize
64KB

Download
memory/2996-24-0x0000000006DB0000-0x0000000006E00000-memory.dmp

Filesize
320KB

Download
memory/2996-25-0x0000000005B00000-0x0000000005B10000-memory.dmp

Filesize
64KB

Download