f6dd6940ca3a024c34b5b29485c443669287d62cc1636de0b80a0f4d60cf21e0 | Triage

Resubmissions

23-02-2024 20:21

240223-y5gvlshc9t 5

23-02-2024 20:18

240223-y292zshc7z 5

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240221-de
resource tags

arch:x64arch:x86image:win7-20240221-delocale:de-deos:windows7-x64systemwindows
submitted
23-02-2024 20:21

Sharing

Report Analysis Logs

General

Target

Own-Spoofer.V.7.exe
Size

583KB
MD5

1d15edd847c1e0960965e683fa877f1a
SHA1

98ccaad041bf0ab1705daa298d5779fc6e1d913c
SHA256

f6dd6940ca3a024c34b5b29485c443669287d62cc1636de0b80a0f4d60cf21e0
SHA512

c5e6be91494e1d0546502a52de1e872be4c7484df9cdafb6e8d9a027e85f5c8db4306a512086246ad7747016210ffbf65b8d3e6c9e685950db0a75a29807a763
SSDEEP

12288:ethjNbNln4n2xstO96UB/FtxDgchGVq2M+z:KjNBl4nO96URBDgt/j

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2196	Own-Spoofer.V.7.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2944	2196	Own-Spoofer.V.7.exe	29
PID 2196 wrote to memory of 2944	2196	Own-Spoofer.V.7.exe	29
PID 2196 wrote to memory of 2944	2196	Own-Spoofer.V.7.exe	29
PID 2944 wrote to memory of 2176	2944	cmd.exe	30
PID 2944 wrote to memory of 2176	2944	cmd.exe	30
PID 2944 wrote to memory of 2176	2944	cmd.exe	30
PID 2944 wrote to memory of 1672	2944	cmd.exe	32
PID 2944 wrote to memory of 1672	2944	cmd.exe	32
PID 2944 wrote to memory of 1672	2944	cmd.exe	32
PID 2944 wrote to memory of 2076	2944	cmd.exe	31
PID 2944 wrote to memory of 2076	2944	cmd.exe	31
PID 2944 wrote to memory of 2076	2944	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\Own-Spoofer.V.7.exe
"C:\Users\Admin\AppData\Local\Temp\Own-Spoofer.V.7.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Own-Spoofer.V.7.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Own-Spoofer.V.7.exe" MD5
    3⤵
    PID:2176
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:2076
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:1672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads