a9faa8d35189935d7d185f68fe04d637a0a8c58e7f6875af096cf86da3306e5d

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 01:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Purchase Inquiry_#466789.exe
Size

522KB
MD5

5eece0f9333721c96803f39becae9fa3
SHA1

4508905c92a34c55d3b9b9fa5700c6b640b9a200
SHA256

706a564a593479d9948fe8cfe542c4a788a80e3d08c38dc888179c5340023a08
SHA512

09922db0f9814db2398c2f468a56168e36d2b272aafd401dfc607ab78d3599552843cafab443bc6d64997d64fe51774b50adfe952a1938e70390df2d71602144
SSDEEP

12288:EOoSQi8LkpEauXFg5bb4P2mvtjB7NAtAHyDBWjUNoxsdlh62b7e7kR:7LvjE9XFxP2mVN7quHydWjUeWLOe

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

Purchase Inquiry_#466789.exe

pid	process
2236	Purchase Inquiry_#466789.exe
2236	Purchase Inquiry_#466789.exe
2236	Purchase Inquiry_#466789.exe
2236	Purchase Inquiry_#466789.exe
2236	Purchase Inquiry_#466789.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Purchase Inquiry_#466789.exe

description pid process

Token: SeDebugPrivilege 2236 Purchase Inquiry_#466789.exe

description	pid	process
Token: SeDebugPrivilege	2236	Purchase Inquiry_#466789.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

Purchase Inquiry_#466789.exe

description	pid	process	target process
PID 2236 wrote to memory of 3056	2236	Purchase Inquiry_#466789.exe	Purchase Inquiry_#466789.exe
PID 2236 wrote to memory of 3056	2236	Purchase Inquiry_#466789.exe	Purchase Inquiry_#466789.exe
PID 2236 wrote to memory of 3056	2236	Purchase Inquiry_#466789.exe	Purchase Inquiry_#466789.exe
PID 2236 wrote to memory of 3056	2236	Purchase Inquiry_#466789.exe	Purchase Inquiry_#466789.exe
PID 2236 wrote to memory of 2600	2236	Purchase Inquiry_#466789.exe	Purchase Inquiry_#466789.exe
PID 2236 wrote to memory of 2600	2236	Purchase Inquiry_#466789.exe	Purchase Inquiry_#466789.exe
PID 2236 wrote to memory of 2600	2236	Purchase Inquiry_#466789.exe	Purchase Inquiry_#466789.exe
PID 2236 wrote to memory of 2600	2236	Purchase Inquiry_#466789.exe	Purchase Inquiry_#466789.exe
PID 2236 wrote to memory of 2564	2236	Purchase Inquiry_#466789.exe	Purchase Inquiry_#466789.exe
PID 2236 wrote to memory of 2564	2236	Purchase Inquiry_#466789.exe	Purchase Inquiry_#466789.exe
PID 2236 wrote to memory of 2564	2236	Purchase Inquiry_#466789.exe	Purchase Inquiry_#466789.exe
PID 2236 wrote to memory of 2564	2236	Purchase Inquiry_#466789.exe	Purchase Inquiry_#466789.exe
PID 2236 wrote to memory of 2648	2236	Purchase Inquiry_#466789.exe	Purchase Inquiry_#466789.exe
PID 2236 wrote to memory of 2648	2236	Purchase Inquiry_#466789.exe	Purchase Inquiry_#466789.exe
PID 2236 wrote to memory of 2648	2236	Purchase Inquiry_#466789.exe	Purchase Inquiry_#466789.exe
PID 2236 wrote to memory of 2648	2236	Purchase Inquiry_#466789.exe	Purchase Inquiry_#466789.exe
PID 2236 wrote to memory of 2664	2236	Purchase Inquiry_#466789.exe	Purchase Inquiry_#466789.exe
PID 2236 wrote to memory of 2664	2236	Purchase Inquiry_#466789.exe	Purchase Inquiry_#466789.exe
PID 2236 wrote to memory of 2664	2236	Purchase Inquiry_#466789.exe	Purchase Inquiry_#466789.exe
PID 2236 wrote to memory of 2664	2236	Purchase Inquiry_#466789.exe	Purchase Inquiry_#466789.exe

C:\Users\Admin\AppData\Local\Temp\Purchase Inquiry_#466789.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase Inquiry_#466789.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2236

C:\Users\Admin\AppData\Local\Temp\Purchase Inquiry_#466789.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase Inquiry_#466789.exe"
2⤵
PID:3056

C:\Users\Admin\AppData\Local\Temp\Purchase Inquiry_#466789.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase Inquiry_#466789.exe"
2⤵
PID:2600

C:\Users\Admin\AppData\Local\Temp\Purchase Inquiry_#466789.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase Inquiry_#466789.exe"
2⤵
PID:2564

C:\Users\Admin\AppData\Local\Temp\Purchase Inquiry_#466789.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase Inquiry_#466789.exe"
2⤵
PID:2648

C:\Users\Admin\AppData\Local\Temp\Purchase Inquiry_#466789.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase Inquiry_#466789.exe"
2⤵
PID:2664

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2236-0-0x0000000074B8E000-0x0000000074B8F000-memory.dmp

Filesize
4KB

Download
memory/2236-1-0x00000000003E0000-0x0000000000464000-memory.dmp

Filesize
528KB

Download
memory/2236-2-0x0000000074B80000-0x000000007526E000-memory.dmp

Filesize
6.9MB

Download
memory/2236-3-0x0000000001FF0000-0x000000000200A000-memory.dmp

Filesize
104KB

Download
memory/2236-4-0x0000000000660000-0x0000000000670000-memory.dmp

Filesize
64KB

Download
memory/2236-5-0x00000000049A0000-0x0000000004A02000-memory.dmp

Filesize
392KB

Download
memory/2236-6-0x0000000074B80000-0x000000007526E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads