f6dd6940ca3a024c34b5b29485c443669287d62cc1636de0b80a0f4d60cf21e0 | Triage

Resubmissions

23/02/2024, 20:21

240223-y5gvlshc9t 5

23/02/2024, 20:18

240223-y292zshc7z 5

Analysis

max time kernel
144s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240221-de
resource tags

arch:x64arch:x86image:win10v2004-20240221-delocale:de-deos:windows10-2004-x64systemwindows
submitted
23/02/2024, 20:18

Sharing

Report Analysis Logs

General

Target

Own-Spoofer.V.7.exe
Size

583KB
MD5

1d15edd847c1e0960965e683fa877f1a
SHA1

98ccaad041bf0ab1705daa298d5779fc6e1d913c
SHA256

f6dd6940ca3a024c34b5b29485c443669287d62cc1636de0b80a0f4d60cf21e0
SHA512

c5e6be91494e1d0546502a52de1e872be4c7484df9cdafb6e8d9a027e85f5c8db4306a512086246ad7747016210ffbf65b8d3e6c9e685950db0a75a29807a763
SSDEEP

12288:ethjNbNln4n2xstO96UB/FtxDgchGVq2M+z:KjNBl4nO96URBDgt/j

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
864	Own-Spoofer.V.7.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 3616	864	Own-Spoofer.V.7.exe	86
PID 864 wrote to memory of 3616	864	Own-Spoofer.V.7.exe	86
PID 3616 wrote to memory of 3576	3616	cmd.exe	87
PID 3616 wrote to memory of 3576	3616	cmd.exe	87
PID 3616 wrote to memory of 2672	3616	cmd.exe	89
PID 3616 wrote to memory of 2672	3616	cmd.exe	89
PID 3616 wrote to memory of 4128	3616	cmd.exe	88
PID 3616 wrote to memory of 4128	3616	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\Own-Spoofer.V.7.exe
"C:\Users\Admin\AppData\Local\Temp\Own-Spoofer.V.7.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Own-Spoofer.V.7.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3616
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Own-Spoofer.V.7.exe" MD5
    3⤵
    PID:3576
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:4128
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:2672

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads