Analysis
- max time kernel
0s - max time network
3s - platform
windows7_x64 - resource
win7-20240220-en - resource tags
- submitted
02/03/2024, 14:38
General
- Target VirusShare_0a03959d5b3359e5a15071021b1ab835.exe
- Size 34KB
- Sample240302-rz6s8aee93
- SHA256 a548db28b8cb6b38459edbed04a58a2edf0fbee15b21f4c1391592c41f88e89f
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_0a03959d5b3359e5a15071021b1ab835.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_0a03959d5b3359e5a15071021b1ab835.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\taskmanager.exe"C:\Users\Admin\AppData\Roaming\taskmanager.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
taskmanager.exe
memory/2836-1-0x000007FEF5B40000-0x000007FEF64DD000-memory.dmp
memory/2836-2-0x0000000001F10000-0x0000000001F90000-memory.dmp
memory/2836-9-0x000007FEF5B40000-0x000007FEF64DD000-memory.dmp
memory/2836-11-0x000007FEF5B40000-0x000007FEF64DD000-memory.dmp
memory/2904-10-0x000007FEF5B40000-0x000007FEF64DD000-memory.dmp