Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/05/2024, 07:46

General

  • Target

    Scan Document_doc.exe

  • Size

    737KB

  • MD5

    de06bb346124a7abd89f75b19ef99ec8

  • SHA1

    1860df154b93ebddef07a088b0356238cf0cd68a

  • SHA256

    0b348678902c0f9bf136572b4168cb697403ecb88c58151c5cbecf7cac9bcd7b

  • SHA512

    235e12f5191d133c44b8d4230b1fc060af510e0619e729c8a6e15283c68d7aa5e6b91750155d9700196e8c84d16788d570ae701a0f71c714f7c69478dcc79f94

  • SSDEEP

    12288:42iKVXE+dJS4Vc0izHQCUoZynTiLg4Tj6LrF3n4vW/jtz42WL2ytIGTEaD8v:LLE8ScYXbZbsz94vARs2WLJEaQ

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 5 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3524
    • C:\Users\Admin\AppData\Local\Temp\Scan Document_doc.exe
      "C:\Users\Admin\AppData\Local\Temp\Scan Document_doc.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:4280
      • C:\Users\Admin\AppData\Local\Temp\Scan Document_doc.exe
        "C:\Users\Admin\AppData\Local\Temp\Scan Document_doc.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        PID:2984
    • C:\Windows\SysWOW64\upnpcont.exe
      "C:\Windows\SysWOW64\upnpcont.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2864
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        3⤵
          PID:1652
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4672,i,15142778360084620907,1763097090506261076,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:8
      1⤵
        PID:4728

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/1652-35-0x0000018CD9FD0000-0x0000018CDA0C1000-memory.dmp

              Filesize

              964KB

            • memory/2864-19-0x0000000001070000-0x00000000010AF000-memory.dmp

              Filesize

              252KB

            • memory/2864-27-0x0000000001070000-0x00000000010AF000-memory.dmp

              Filesize

              252KB

            • memory/2864-25-0x0000000001730000-0x00000000017CE000-memory.dmp

              Filesize

              632KB

            • memory/2864-24-0x0000000001070000-0x00000000010AF000-memory.dmp

              Filesize

              252KB

            • memory/2864-23-0x00000000018B0000-0x0000000001BFA000-memory.dmp

              Filesize

              3.3MB

            • memory/2864-20-0x0000000001070000-0x00000000010AF000-memory.dmp

              Filesize

              252KB

            • memory/2984-21-0x0000000000400000-0x0000000000442000-memory.dmp

              Filesize

              264KB

            • memory/2984-22-0x0000000001260000-0x000000000127F000-memory.dmp

              Filesize

              124KB

            • memory/2984-10-0x0000000000400000-0x0000000000442000-memory.dmp

              Filesize

              264KB

            • memory/2984-13-0x00000000012F0000-0x000000000163A000-memory.dmp

              Filesize

              3.3MB

            • memory/2984-14-0x0000000000400000-0x0000000000442000-memory.dmp

              Filesize

              264KB

            • memory/2984-15-0x0000000000400000-0x0000000000442000-memory.dmp

              Filesize

              264KB

            • memory/2984-16-0x0000000000400000-0x0000000000442000-memory.dmp

              Filesize

              264KB

            • memory/2984-17-0x0000000001260000-0x000000000127F000-memory.dmp

              Filesize

              124KB

            • memory/3524-36-0x0000000002EE0000-0x0000000002FC9000-memory.dmp

              Filesize

              932KB

            • memory/3524-29-0x0000000002EE0000-0x0000000002FC9000-memory.dmp

              Filesize

              932KB

            • memory/3524-18-0x000000000C8C0000-0x000000000E193000-memory.dmp

              Filesize

              24.8MB

            • memory/3524-28-0x0000000002EE0000-0x0000000002FC9000-memory.dmp

              Filesize

              932KB

            • memory/3524-26-0x000000000C8C0000-0x000000000E193000-memory.dmp

              Filesize

              24.8MB

            • memory/4280-7-0x00000000069C0000-0x00000000069D0000-memory.dmp

              Filesize

              64KB

            • memory/4280-0-0x0000000074C9E000-0x0000000074C9F000-memory.dmp

              Filesize

              4KB

            • memory/4280-5-0x0000000005610000-0x000000000561A000-memory.dmp

              Filesize

              40KB

            • memory/4280-4-0x0000000074C90000-0x0000000075440000-memory.dmp

              Filesize

              7.7MB

            • memory/4280-3-0x0000000005660000-0x00000000056F2000-memory.dmp

              Filesize

              584KB

            • memory/4280-6-0x00000000069A0000-0x00000000069B8000-memory.dmp

              Filesize

              96KB

            • memory/4280-2-0x0000000005CF0000-0x0000000006294000-memory.dmp

              Filesize

              5.6MB

            • memory/4280-8-0x00000000083A0000-0x000000000842A000-memory.dmp

              Filesize

              552KB

            • memory/4280-12-0x0000000074C90000-0x0000000075440000-memory.dmp

              Filesize

              7.7MB

            • memory/4280-1-0x0000000000BA0000-0x0000000000C5E000-memory.dmp

              Filesize

              760KB

            • memory/4280-9-0x000000000AB10000-0x000000000ABAC000-memory.dmp

              Filesize

              624KB