f6dd6940ca3a024c34b5b29485c443669287d62cc1636de0b80a0f4d60cf21e0

Resubmissions

23/02/2024, 20:21

240223-y5gvlshc9t 5

23/02/2024, 20:18

240223-y292zshc7z 5

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20240221-de
resource tags

arch:x64arch:x86image:win7-20240221-delocale:de-deos:windows7-x64systemwindows
submitted
23/02/2024, 20:18

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Own-Spoofer.V.7.exe
Size

583KB
MD5

1d15edd847c1e0960965e683fa877f1a
SHA1

98ccaad041bf0ab1705daa298d5779fc6e1d913c
SHA256

f6dd6940ca3a024c34b5b29485c443669287d62cc1636de0b80a0f4d60cf21e0
SHA512

c5e6be91494e1d0546502a52de1e872be4c7484df9cdafb6e8d9a027e85f5c8db4306a512086246ad7747016210ffbf65b8d3e6c9e685950db0a75a29807a763
SSDEEP

12288:ethjNbNln4n2xstO96UB/FtxDgchGVq2M+z:KjNBl4nO96URBDgt/j

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1868	Own-Spoofer.V.7.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2580	timeout.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 2464	1868	Own-Spoofer.V.7.exe	29
PID 1868 wrote to memory of 2464	1868	Own-Spoofer.V.7.exe	29
PID 1868 wrote to memory of 2464	1868	Own-Spoofer.V.7.exe	29
PID 2464 wrote to memory of 3040	2464	cmd.exe	32
PID 2464 wrote to memory of 3040	2464	cmd.exe	32
PID 2464 wrote to memory of 3040	2464	cmd.exe	32
PID 2464 wrote to memory of 2624	2464	cmd.exe	31
PID 2464 wrote to memory of 2624	2464	cmd.exe	31
PID 2464 wrote to memory of 2624	2464	cmd.exe	31
PID 2464 wrote to memory of 2728	2464	cmd.exe	30
PID 2464 wrote to memory of 2728	2464	cmd.exe	30
PID 2464 wrote to memory of 2728	2464	cmd.exe	30
PID 1868 wrote to memory of 2764	1868	Own-Spoofer.V.7.exe	34
PID 1868 wrote to memory of 2764	1868	Own-Spoofer.V.7.exe	34
PID 1868 wrote to memory of 2764	1868	Own-Spoofer.V.7.exe	34
PID 2764 wrote to memory of 2532	2764	cmd.exe	35
PID 2764 wrote to memory of 2532	2764	cmd.exe	35
PID 2764 wrote to memory of 2532	2764	cmd.exe	35
PID 1868 wrote to memory of 880	1868	Own-Spoofer.V.7.exe	37
PID 1868 wrote to memory of 880	1868	Own-Spoofer.V.7.exe	37
PID 1868 wrote to memory of 880	1868	Own-Spoofer.V.7.exe	37
PID 2532 wrote to memory of 2580	2532	cmd.exe	39
PID 2532 wrote to memory of 2580	2532	cmd.exe	39
PID 2532 wrote to memory of 2580	2532	cmd.exe	39

C:\Users\Admin\AppData\Local\Temp\Own-Spoofer.V.7.exe
"C:\Users\Admin\AppData\Local\Temp\Own-Spoofer.V.7.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Own-Spoofer.V.7.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:2728
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:2624
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Own-Spoofer.V.7.exe" MD5
    3⤵
    PID:3040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo SSL connect error && timeout /t 5"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Windows\system32\cmd.exe
    cmd /C "color b && title Error && echo SSL connect error && timeout /t 5"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2532
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2580
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1868 -s 122404
  2⤵
  PID:880

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:2444

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x524
1⤵
PID:2828

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:2116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2116-1-0x00000000026E0000-0x00000000026E1000-memory.dmp

Filesize
4KB

Download
memory/2444-0-0x0000000002830000-0x0000000002831000-memory.dmp

Filesize
4KB

Download