Analysis
- max time kernel
14s - max time network
23s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
02/03/2024, 15:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
VirusShare_0a04ec051b006c778b00cf7c3cce258.exe
Resource
win7-20240220-en
windows7-x64
8 signatures
150 seconds
General
- Target VirusShare_0a04ec051b006c778b00cf7c3cce258.exe
- Size 960KB
- Sample240302-stsj3see6w
- SHA256 dcbbc1247ed53dcc69f7f0b6177327dd4fb3efcc74b48bced60fc062aa9b2c75
- MD5 0a04ec051b006c778b00cf7c3cce258c
- SHA1 707c419bbde10904443df90fb799b1f51ec02c5c
- SHA512 2d20df01796a7d5df6ff075c6d3aa08ed4c0f4a4a994fda57e98e99e0b1f20e48d0e3133e3b01740accd24b8ed574d2740118244263635bff376dd3cdfe54af5
- SSDEEP 12288:aKbUFiirBDwAMGLBY5/LfmJssN1EYXcfcW9Y4y1Vy34f4KBbqum7UeEXyX71GoeG:Gi++w0Lica84PEUl6m9
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VirusShare_0a04ec051b006c778b00cf7c3cce258.exe VirusShare_0a04ec051b006c778b00cf7c3cce258.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VirusShare_0a04ec051b006c778b00cf7c3cce258.exe VirusShare_0a04ec051b006c778b00cf7c3cce258.exe - Executes dropped EXE 1 IoCs
pid Process 3752 Inject to.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1456 set thread context of 3752 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 93 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe - Suspicious use of AdjustPrivilegeToken 25 IoCs
description pid Process Token: SeDebugPrivilege 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe Token: SeIncreaseQuotaPrivilege 3752 Inject to.exe Token: SeSecurityPrivilege 3752 Inject to.exe Token: SeTakeOwnershipPrivilege 3752 Inject to.exe Token: SeLoadDriverPrivilege 3752 Inject to.exe Token: SeSystemProfilePrivilege 3752 Inject to.exe Token: SeSystemtimePrivilege 3752 Inject to.exe Token: SeProfSingleProcessPrivilege 3752 Inject to.exe Token: SeIncBasePriorityPrivilege 3752 Inject to.exe Token: SeCreatePagefilePrivilege 3752 Inject to.exe Token: SeBackupPrivilege 3752 Inject to.exe Token: SeRestorePrivilege 3752 Inject to.exe Token: SeShutdownPrivilege 3752 Inject to.exe Token: SeDebugPrivilege 3752 Inject to.exe Token: SeSystemEnvironmentPrivilege 3752 Inject to.exe Token: SeChangeNotifyPrivilege 3752 Inject to.exe Token: SeRemoteShutdownPrivilege 3752 Inject to.exe Token: SeUndockPrivilege 3752 Inject to.exe Token: SeManageVolumePrivilege 3752 Inject to.exe Token: SeImpersonatePrivilege 3752 Inject to.exe Token: SeCreateGlobalPrivilege 3752 Inject to.exe Token: 33 3752 Inject to.exe Token: 34 3752 Inject to.exe Token: 35 3752 Inject to.exe Token: 36 3752 Inject to.exe - Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 1456 wrote to memory of 3508 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 90 PID 1456 wrote to memory of 3508 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 90 PID 1456 wrote to memory of 3508 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 90 PID 3508 wrote to memory of 3444 3508 csc.exe 92 PID 3508 wrote to memory of 3444 3508 csc.exe 92 PID 3508 wrote to memory of 3444 3508 csc.exe 92 PID 1456 wrote to memory of 3752 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 93 PID 1456 wrote to memory of 3752 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 93 PID 1456 wrote to memory of 3752 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 93 PID 1456 wrote to memory of 3752 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 93 PID 1456 wrote to memory of 3752 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 93 PID 1456 wrote to memory of 3752 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 93 PID 1456 wrote to memory of 3752 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 93 PID 1456 wrote to memory of 3752 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 93 PID 1456 wrote to memory of 3752 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 93 PID 1456 wrote to memory of 3752 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 93 PID 1456 wrote to memory of 3752 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 93 PID 1456 wrote to memory of 3752 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 93 PID 1456 wrote to memory of 3752 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 93 PID 1456 wrote to memory of 3752 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 93 PID 1456 wrote to memory of 3996 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 94 PID 1456 wrote to memory of 3996 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 94 PID 1456 wrote to memory of 3996 1456 VirusShare_0a04ec051b006c778b00cf7c3cce258.exe 94 PID 3996 wrote to memory of 3512 3996 csc.exe 96 PID 3996 wrote to memory of 3512 3996 csc.exe 96 PID 3996 wrote to memory of 3512 3996 csc.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_0a04ec051b006c778b00cf7c3cce258.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_0a04ec051b006c778b00cf7c3cce258.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yxeq6t9v.cmdline"2⤵
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6CE4.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6CE3.tmp"3⤵PID:3444
-
-
-
C:\Users\Admin\AppData\Roaming\Inject to.exe"C:\Users\Admin\AppData\Roaming\Inject to.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3752
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wmfmw6yp.cmdline"2⤵
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6ED8.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6ED7.tmp"3⤵PID:3512
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\RES6CE4.tmp
- Size 1KB
- SHA256 40dfc874543fba26082331f41d0b5dfe899c453ed111674f0cb4f4cffc9f04f8
- MD5 44eb153177ef745a566c22dfb536e2a0
- SHA1 8537c187ca9ed3f87187034307cb2b68f8d40b20
- SHA512 56ea0f42eceac20374e6f276d83972ddce96125de02ef35f2a4c9f72ce7149ab2cc17d385b5a9ba01f65d32818965f8f4022e90123e7c4afeab1c6464fa92cab
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\RES6ED8.tmp
- Size 1KB
- SHA256 98d113452606d23d6434210863dc678a5736501f58b01ae7e4a64760e6276618
- MD5 d0a9f6452cc75684a5bf003eddb32c89
- SHA1 a5c4507bf82e59cb116ee8c3a4b5795614653f0d
- SHA512 3b407fc2217c8cd7e6e8d11d9c895817551b30ebc68b20372a85ab415c5e9863b1c91a02bf824cc26ced91e58fdb1ab4ecdd3d2a2268e4f485165079f8f1ea05
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\wmfmw6yp.dll
- Size 5KB
- SHA256 094e5217d4ab8e43a45a80c7fbea302db34d6161294019a6186d11070ecd6d4d
- MD5 7646490d36076b2bc631067d97a9d3d5
- SHA1 a4782497cab116292f1c04c9dafcd29ed522f51b
- SHA512 62a28945343c000bfbf199cd38974fc8075c596f09de78ff5acc2f4f3640eb88c77fdedefe01408812f55b593b352761bef02adcc15f031e9ec621a1618c21a6
- SSDEEP 48:602ClYL+p6vIdEfjuiAgqS3w1i08rKYxSel+W1lltRs7FAeZXwSKvKFJgE0PgkiS:VCnDo83fIUTzE0PgPACKyYDBK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\yxeq6t9v.dll
- Size 8KB
- SHA256 744422fa49443de0013e0aa4ae6bea4867c5f08c3d1affbe4b4a0660a4fad30d
- MD5 8278eb02abb8123d9885fe87bea1c75a
- SHA1 7b7f4759b25601204674d97f45e9fd1a3797a672
- SHA512 51c26ac7a210acf917a00907148de3f894251a718e464d6e625874faf99050f53ebafb5eeaef0ae5b9ba52a811138ca43e9b0b92c75deb4c826cf334c9499169
- SSDEEP 96:W1klm+D+wnqQfaFfe1Pf6hzSGIap0lQ4DAHch4ZMr0eK:W1aNDfnquae1Ompa+jNhy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Inject to.exe
- Size 1024B
- SHA256 10e27401a17c642ae0f0622513f6e1882f097eda2deba55977f7898531f46671
- MD5 855d01dcc08eda06b71fefc7c3201afb
- SHA1 60dbeb18017fd98ad32f7fc1dc016d1bcbc9bcb7
- SHA512 8028f63a2105d8d9efcef76ed45b5bd211e9c5b1e243b385b1998515087d6279e96e92a7f7698289597a20d4f5ebbdc95adb60060fa5fbbf0936b50a44fc8151
- MD5 SHA1 SHA512
- Path \??\c:\Users\Admin\AppData\Local\Temp\CSC6CE3.tmp
- Size 652B
- SHA256 20b693351d4424b822e28cadb644816cff925a70308047590d590b4a6f72b4bc
- MD5 8cb32103525b90718e19278ab097429a
- SHA1 381a925f9b3c4fc044aea0a90c27070a387247aa
- SHA512 16ca8493e7ab084cae2e7d1a8774921d9b06659a1eb9e91dbca866d87e0fd95565664361f398790a61d78b0507e4d271b414400069feb5b8ba7aa1aca95a7be7
- MD5 SHA1 SHA512
- Path \??\c:\Users\Admin\AppData\Local\Temp\CSC6ED7.tmp
- Size 652B
- SHA256 d2e3dde6ab86ab6b86b8fd2f2594f507f9bd35eea723c284597846cf4f19c3cb
- MD5 ea8744d847cc9ae611e061894099b4c8
- SHA1 d52b99a003549bf4a49fc0e35156c54e59ab0c27
- SHA512 86ffd44d5d3172432ea876b4b0dd3b1bdd69bc97b0d547eb6822adf9cffb3514699b0976183733ad66d3f4329e3f99e9044f894f3039778516db37614656d1f6
- MD5 SHA1 SHA512
- Path \??\c:\Users\Admin\AppData\Local\Temp\wmfmw6yp.0.cs
- Size 3KB
- SHA256 03928f10904ba363d8e763f42883e9c9e6a54f5514b323c48fca4ace6f8d2b71
- MD5 412e1c803f61cea207aa4b53c9b4a3bb
- SHA1 79b56c2016e0eb4e0de20ef8085dd8caa2b0a810
- SHA512 9cb9f92cee9e2b22424c8c0f60b53143ff7799a61a06a02291102912208311fb41ea95e16a175f46fbf0cce41b2f18f4eacaa5ae60625aa0e89beec5ac299b3b
- MD5 SHA1 SHA512
- Path \??\c:\Users\Admin\AppData\Local\Temp\wmfmw6yp.cmdline
- Size 187B
- SHA256 2d7b04ae22d09651627f33fa337f0707078b0783c36e06e663a60d31c7954039
- MD5 2e7e975082053e1082d5318ad26dade1
- SHA1 a70a75a54a7fcebfd0e50c113453a78f4504756d
- SHA512 1273e5abd75b4c64da0a4bf75d92a4f55080292f8c9665282fbdaae9c8172c29faa681136a7bb32b8281b37d6065542ab5141e235604abb44615c951a22051e7
- MD5 SHA1 SHA512
- Path \??\c:\Users\Admin\AppData\Local\Temp\yxeq6t9v.0.cs
- Size 6KB
- SHA256 321952c2c98fb6c307deff53b2534c63df40bc2739d654cdc1c02f98bc64c7b1
- MD5 ec02f26fb5424b5fbc9bcef4abb87993
- SHA1 86082c6c15bdf457dcabdbab286457d0bf92b24c
- SHA512 1de05d23a61dd39d240855559d481208eb91b034c71a331e9f70e6930473eab7a014f375446116bde627635184d6bc7340ebcfe08ee10d801b7ba5dc9ffaedb2
- SSDEEP 96:J1o0fwC5l5yDLu0l2VQNTEG5TrV5rkEUGTR:9Nl8z0VQNTE0rV5IEUGTR
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Users\Admin\AppData\Local\Temp\yxeq6t9v.cmdline
- Size 187B
- SHA256 a19ce8fa1382c66e1d925aa45ac68afab5387a635931568f6589af553d21ec93
- MD5 eb6bb37c803cd855d4cc39b869ec9507
- SHA1 c167ada6550f46f714f4164e3100c310a3ca2c21
- SHA512 7885671365dfd3b1fd229be119fbf40b9cbfbb62e31763395aa3fed2be7dc8f760854730c7ddc6b5aa3df3a17c14507779d619dfa0dae73fe962d71d99c00cb4
- MD5 SHA1 SHA512