Analysis
-
max time kernel
1484s -
max time network
1501s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
-
submitted
10/03/2024, 09:40
General
-
Target
App.Setap/Setup.exe
-
Size
53KB
-
MD5
e5ea5d841cb79942698c4e952a199a29
-
SHA1
ebe0e313c26f87af8ddf4a5f0fad1a68fc5f59d5
-
SHA256
8e478da3eff27b1be19a893314927385156a62582d8ceffb5be2c8852aff19d7
-
SHA512
f3aad0d51939184282327a0ed5544f4a9dc71e6b46409909a11dd440680301b5d5c160d58c9586f68800ac544b6573c8215a0a32c270acf0bc611ebbb219e0c0
-
SSDEEP
768:LNF2WLAuDeGJiqrmehiVSrmaBP39V5+5CYiUFr3HPxWE2plx:LNS7qjh3rmKPND+5C7UdPxg
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\App.Setap\Setup.exe"C:\Users\Admin\AppData\Local\Temp\App.Setap\Setup.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\more.comC:\Windows\SysWOW64\more.com2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\WinAPIHObj.au3C:\Users\Admin\AppData\Local\Temp\WinAPIHObj.au33⤵
- Loads dropped DLL
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
925KB
MD50162a97ed477353bc35776a7addffd5c
SHA110db8fe20bbce0f10517c510ec73532cf6feb227
SHA25615600ccdef5a64b40d206d89234a51be1e11bd878dcefc5986590bcf40d9d571
SHA5129638cab1aabe78c22a3d3528a391544f697d792640d831516b63fa52c393ee96bb588223e70163d059208cc5a14481c5ff7ef6ba9ac572322798a823d67f01f5
-
Filesize
2.0MB
-
Filesize
292KB
-
Filesize
940KB
-
Filesize
4KB
-
Filesize
292KB
-
Filesize
2.0MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB