8be8963a80cfd2dbe3fe2977a98d943bec0d93341aa14b16c2a902743a2849ca | Triage

Resubmissions

23-05-2024 13:07

240523-qc46facb73 3

23-05-2024 12:26

240523-pl9a3she88 3

23-05-2024 11:55

240523-n3stzsfe93 3

Analysis

max time kernel
594s
max time network
604s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 12:26

Sharing

Report Analysis Logs

General

Target

minio-test.exe
Size

9.2MB
MD5

a2c607d98349a40139203ee174430276
SHA1

5f211bb82b4709ff0a0b52e4cb8037ccc982f428
SHA256

8be8963a80cfd2dbe3fe2977a98d943bec0d93341aa14b16c2a902743a2849ca
SHA512

17c3405b1407d62ed7d0afe0a7f1357b8131f13257935f8cab5e269648ba58d45abe59bda6db9d24c2ae051130f98120497e8e3e447916e4a39f8fa279d24c2b
SSDEEP

98304:eeY2hUjy3X0rQ1JLJWEll4V31RJhZh5XeM76aBQsGvfMk/3zwPP:rYKD3X0rGXTIttfXfuau9d/MP

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 2712	4568	cmd.exe	129
PID 4568 wrote to memory of 2712	4568	cmd.exe	129
PID 4568 wrote to memory of 4452	4568	cmd.exe	130
PID 4568 wrote to memory of 4452	4568	cmd.exe	130
PID 4568 wrote to memory of 768	4568	cmd.exe	133
PID 4568 wrote to memory of 768	4568	cmd.exe	133
PID 4568 wrote to memory of 740	4568	cmd.exe	134
PID 4568 wrote to memory of 740	4568	cmd.exe	134

C:\Users\Admin\AppData\Local\Temp\minio-test.exe
"C:\Users\Admin\AppData\Local\Temp\minio-test.exe"
1⤵
PID:4684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3212,i,14648456027158448592,4956305794400220180,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:8
1⤵
PID:3136

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5052

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Users\Admin\Desktop\minio-test.exe
  minio-test.exe
  2⤵
  PID:2712
- C:\Users\Admin\Desktop\minio-test.exe
  minio-test.exe --help
  2⤵
  PID:4452
- C:\Users\Admin\Desktop\minio-test.exe
  minio-test.exe -endpoint google.com
  2⤵
  PID:768
- C:\Users\Admin\Desktop\minio-test.exe
  minio-test.exe -endpoint minio.com
  2⤵
  PID:740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4136,i,14648456027158448592,4956305794400220180,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:8
1⤵
PID:4840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads