68c7f47340b9436795d4e362e4586ef288194b43e6d670b4ee6f345959d5726c

Resubmissions

22/05/2024, 14:33

240522-rw846see6s

22/05/2024, 14:32

240522-rv83saee4s10

22/05/2024, 14:30

240522-rvkp7aed6310

Analysis

max time kernel
143s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 14:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
The Main Setup/Setup.exe
Size 5.6MB
Sample240522-rv83saee4s
SHA256 2b00b2609b49a41c2d97dba17df688c9f3648802cdfbad4a05b7f8940d2b5493
MD5 9f9326b849a903960fc95a43c4148b5d
SHA1 128c55ae79a1e8709b6cea98ad46f1a8bbe80da2
SHA512 82c3c468caa86a2965253118b36e19d5f31724b9690186c773eef01055b0cbfd1909235f4430234748dc79e61051206dd2452d7e4862aaffaf9ae97698bcf474
SSDEEP 98304:IFMA3nuSaP3z4K4nJi6wTgnKsMJOrVjcofsxrlKkRmITJLOi19aOD4OiZrq1DfPy:ICsnuS2oirObfsxrlj40tOi19aOD4O7S
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2208 set thread context of 1680	2208	Setup.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2460	2440	WerFault.exe	30

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2208	Setup.exe
2208	Setup.exe
1680	netsh.exe
1680	netsh.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2208	Setup.exe
1680	netsh.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2208	Setup.exe
2208	Setup.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 1680	2208	Setup.exe	28
PID 2208 wrote to memory of 1680	2208	Setup.exe	28
PID 2208 wrote to memory of 1680	2208	Setup.exe	28
PID 2208 wrote to memory of 1680	2208	Setup.exe	28
PID 2208 wrote to memory of 1680	2208	Setup.exe	28
PID 1680 wrote to memory of 2440	1680	netsh.exe	30
PID 1680 wrote to memory of 2440	1680	netsh.exe	30
PID 1680 wrote to memory of 2440	1680	netsh.exe	30
PID 1680 wrote to memory of 2440	1680	netsh.exe	30
PID 1680 wrote to memory of 2440	1680	netsh.exe	30
PID 1680 wrote to memory of 2440	1680	netsh.exe	30
PID 2440 wrote to memory of 2460	2440	SearchIndexer.exe	31
PID 2440 wrote to memory of 2460	2440	SearchIndexer.exe	31
PID 2440 wrote to memory of 2460	2440	SearchIndexer.exe	31
PID 2440 wrote to memory of 2460	2440	SearchIndexer.exe	31
PID 1680 wrote to memory of 2440	1680	netsh.exe	30

C:\Users\Admin\AppData\Local\Temp\The Main Setup\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\The Main Setup\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\SysWOW64\netsh.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1680
- - C:\Windows\SysWOW64\SearchIndexer.exe
    C:\Windows\SysWOW64\SearchIndexer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2440
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 120
      4⤵
      Program crash
      PID:2460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

8d7e7dd3

Path C:\Users\Admin\AppData\Local\Temp\8d7e7dd3
Size 1.1MB
SHA256 c508ec0bd5f66a1cb87fff30cb8f807daab8edc84dcf4275b0365f35de64a869
MD5 a1c2401a6fcbcb42ec3d2bd1b4a4ee72
SHA1 c77e57bffec1b60d7260b8265f5d02b507d19c8b
SHA512 c71e30040676c7f19a2aa5b1a0b1e0495d80e35c734f048d2aea8f853797b938d29ac6a77244beb0bb2b9c89004d1906fff7932b6cd0fe550fad698be231518c
SSDEEP 24576:GXeBqhXvDo3UomtqrvJjJFV2ERcrXSbtqM/hLmy0SR+t1ayOuaFxaI:GCUvDo3UomITJtLNRYiJq0b9aOu2f
MD5 SHA1 SHA512 SSDEEP

Submit Download

9121a73c

Path C:\Users\Admin\AppData\Local\Temp\9121a73c
Size 1001KB
SHA256 4fbf58b995bb7eb2606f4047922b39d1e5c0aa59ed000545f67393620ac0c6cd
MD5 aff924273fe1fbd5bd3dd1b56e2cbfad
SHA1 3c60ffd42272d1db847b40af686bc4f792310db1
SHA512 d43a79dd25b072c32c77f9561543e22a103336fd38ac6fd97054dd5a1aef427f7a27481fc3ec32429eb0acf34ad605d723bfe656a9e8840bd444d60cd5685903
SSDEEP 24576:97vwM+V6nNrVqZtiLZECki2WG6mfbNIdrNEBLnrZL9Ess:1vwMTNgOdG6mWrNEBFqH
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1680-12-0x0000000074840000-0x00000000749B4000-memory.dmp

Download

memory/1680-20-0x0000000074840000-0x00000000749B4000-memory.dmp

Download

memory/1680-16-0x0000000074840000-0x00000000749B4000-memory.dmp

Download

memory/1680-15-0x0000000074840000-0x00000000749B4000-memory.dmp

Download

memory/1680-14-0x0000000077B50000-0x0000000077CF9000-memory.dmp

Download

memory/2208-9-0x0000000074840000-0x00000000749B4000-memory.dmp

Download

memory/2208-10-0x0000000074840000-0x00000000749B4000-memory.dmp

Download

memory/2208-8-0x0000000074852000-0x0000000074854000-memory.dmp

Download

memory/2208-0-0x0000000000400000-0x00000000009A9000-memory.dmp

Download

memory/2208-7-0x0000000077B50000-0x0000000077CF9000-memory.dmp

Download

memory/2208-6-0x0000000074840000-0x00000000749B4000-memory.dmp

Download

memory/2440-19-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2440-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2440-21-0x00000000000D0000-0x0000000000125000-memory.dmp

Download

memory/2440-22-0x00000000000D0000-0x0000000000125000-memory.dmp

Download

memory/2440-24-0x00000000000D0000-0x0000000000125000-memory.dmp

Download