Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    14/01/2024, 12:35

General

  • Target

    SoftWare.exe

  • Size

    758KB

  • MD5

    0462ee257d052e3ee8a64f9ecb7f5f2f

  • SHA1

    fcaf1010cff904c8e8b46cec2ddd6b0f1fd6aad4

  • SHA256

    0abd9055702e5708497f5cd1032c9f57f5c4b2a5acb60309ef9e605213b1d41b

  • SHA512

    4d9b5dbba521300d1b994754967224b448cd654430388f6993765b6aed7e3454801f798f97e4e997422b4ab060b2746824a240acf2ff8bae0990e5d206730bce

  • SSDEEP

    12288:+i87P1HvYxCi3F2umVkNqnzPmYEF/lHFe0XM5+iPq30zViKBa05R:I7P1PYx13oBtzMTFrXM5+H30zsKBa0

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SoftWare.exe
    "C:\Users\Admin\AppData\Local\Temp\SoftWare.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2408
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
        PID:2496
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        2⤵
          PID:2360

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/2360-13-0x0000000000400000-0x0000000000495000-memory.dmp

              Filesize

              596KB

            • memory/2360-16-0x0000000000400000-0x0000000000495000-memory.dmp

              Filesize

              596KB

            • memory/2360-17-0x0000000000400000-0x0000000000495000-memory.dmp

              Filesize

              596KB

            • memory/2360-9-0x0000000000400000-0x0000000000495000-memory.dmp

              Filesize

              596KB

            • memory/2360-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

              Filesize

              4KB

            • memory/2360-8-0x0000000000400000-0x0000000000495000-memory.dmp

              Filesize

              596KB

            • memory/2360-6-0x0000000000400000-0x0000000000495000-memory.dmp

              Filesize

              596KB

            • memory/2360-7-0x0000000000400000-0x0000000000495000-memory.dmp

              Filesize

              596KB

            • memory/2360-10-0x0000000000400000-0x0000000000495000-memory.dmp

              Filesize

              596KB

            • memory/2408-1-0x00000000740E0000-0x00000000747CE000-memory.dmp

              Filesize

              6.9MB

            • memory/2408-5-0x0000000000380000-0x0000000000381000-memory.dmp

              Filesize

              4KB

            • memory/2408-4-0x0000000000380000-0x0000000000381000-memory.dmp

              Filesize

              4KB

            • memory/2408-0-0x0000000000B90000-0x0000000000C54000-memory.dmp

              Filesize

              784KB

            • memory/2408-3-0x00000000002F0000-0x00000000002F1000-memory.dmp

              Filesize

              4KB

            • memory/2408-14-0x0000000000380000-0x0000000000381000-memory.dmp

              Filesize

              4KB

            • memory/2408-18-0x00000000740E0000-0x00000000747CE000-memory.dmp

              Filesize

              6.9MB

            • memory/2408-2-0x0000000004E70000-0x0000000004EB0000-memory.dmp

              Filesize

              256KB