f6dd6940ca3a024c34b5b29485c443669287d62cc1636de0b80a0f4d60cf21e0 | Triage

Resubmissions

23/02/2024, 20:21

240223-y5gvlshc9t 5

23/02/2024, 20:18

240223-y292zshc7z 5

Analysis

max time kernel
30s
max time network
24s
platform
windows10-1703_x64
resource
win10-20240221-de
resource tags

arch:x64arch:x86image:win10-20240221-delocale:de-deos:windows10-1703-x64systemwindows
submitted
23/02/2024, 20:21

Sharing

Report Analysis Logs

General

Target

Own-Spoofer.V.7.exe
Size

583KB
MD5

1d15edd847c1e0960965e683fa877f1a
SHA1

98ccaad041bf0ab1705daa298d5779fc6e1d913c
SHA256

f6dd6940ca3a024c34b5b29485c443669287d62cc1636de0b80a0f4d60cf21e0
SHA512

c5e6be91494e1d0546502a52de1e872be4c7484df9cdafb6e8d9a027e85f5c8db4306a512086246ad7747016210ffbf65b8d3e6c9e685950db0a75a29807a763
SSDEEP

12288:ethjNbNln4n2xstO96UB/FtxDgchGVq2M+z:KjNBl4nO96URBDgt/j

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3152	Own-Spoofer.V.7.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3152 wrote to memory of 4716	3152	Own-Spoofer.V.7.exe	72
PID 3152 wrote to memory of 4716	3152	Own-Spoofer.V.7.exe	72
PID 4716 wrote to memory of 4628	4716	cmd.exe	73
PID 4716 wrote to memory of 4628	4716	cmd.exe	73
PID 4716 wrote to memory of 3700	4716	cmd.exe	75
PID 4716 wrote to memory of 3700	4716	cmd.exe	75
PID 4716 wrote to memory of 1224	4716	cmd.exe	74
PID 4716 wrote to memory of 1224	4716	cmd.exe	74

C:\Users\Admin\AppData\Local\Temp\Own-Spoofer.V.7.exe
"C:\Users\Admin\AppData\Local\Temp\Own-Spoofer.V.7.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Own-Spoofer.V.7.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4716
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Own-Spoofer.V.7.exe" MD5
    3⤵
    PID:4628
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:1224
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:3700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads