66f397273148e81878a1daa42272ba6fdad47321de1b3c47602c651f164cfedb

General

Target

PI 10287.exe
Size

713KB
MD5

e29a8ad9f43f6dfc0812fbd621e31105
SHA1

3aebe73953d17eb882f31bb6d0fe1e6759bf8bd7
SHA256

2483ca984af41c3fc2e5f6bdf8f954dbf5fc7cae277299056064505ae9b1ad07
SHA512

1c6b63b63760d1f5f8cb19ced607bcb4163b3d955b369ea0692cdc9dc0bb5a662a46600778f7d390f44fcb3d1fd3b9e9e378f445340f5b85adad54b050d09e63
SSDEEP

12288:TfCVIoEmHPjlt7IdA0HFabzWtNc2qmxqG43jfHiEhO2v1uETYnWn2zJwaGipcG+I:GI3mvjlGFaXWtNckqF1O8JkWn2+aqk

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1988 set thread context of 2692	1988	PI 10287.exe	28
PID 2692 set thread context of 1196	2692	RegSvcs.exe	21
PID 2692 set thread context of 2612	2692	RegSvcs.exe	29
PID 2612 set thread context of 1196	2612	iexpress.exe	21

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
1988	PI 10287.exe
1988	PI 10287.exe
2692	RegSvcs.exe
2692	RegSvcs.exe
2692	RegSvcs.exe
2692	RegSvcs.exe
2692	RegSvcs.exe
2692	RegSvcs.exe
2692	RegSvcs.exe
2692	RegSvcs.exe
2612	iexpress.exe
2612	iexpress.exe
2612	iexpress.exe
2612	iexpress.exe
2612	iexpress.exe
2612	iexpress.exe
2612	iexpress.exe
2612	iexpress.exe
2612	iexpress.exe
2612	iexpress.exe
2612	iexpress.exe
2612	iexpress.exe
2612	iexpress.exe
2612	iexpress.exe
2612	iexpress.exe
2612	iexpress.exe
2612	iexpress.exe
2612	iexpress.exe
2612	iexpress.exe
2612	iexpress.exe
2612	iexpress.exe
2612	iexpress.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2692	RegSvcs.exe
1196	Explorer.EXE
1196	Explorer.EXE
2612	iexpress.exe
2612	iexpress.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1988	PI 10287.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 2692	1988	PI 10287.exe	28
PID 1988 wrote to memory of 2692	1988	PI 10287.exe	28
PID 1988 wrote to memory of 2692	1988	PI 10287.exe	28
PID 1988 wrote to memory of 2692	1988	PI 10287.exe	28
PID 1988 wrote to memory of 2692	1988	PI 10287.exe	28
PID 1988 wrote to memory of 2692	1988	PI 10287.exe	28
PID 1988 wrote to memory of 2692	1988	PI 10287.exe	28
PID 1988 wrote to memory of 2692	1988	PI 10287.exe	28
PID 1988 wrote to memory of 2692	1988	PI 10287.exe	28
PID 1988 wrote to memory of 2692	1988	PI 10287.exe	28
PID 1196 wrote to memory of 2612	1196	Explorer.EXE	29
PID 1196 wrote to memory of 2612	1196	Explorer.EXE	29
PID 1196 wrote to memory of 2612	1196	Explorer.EXE	29
PID 1196 wrote to memory of 2612	1196	Explorer.EXE	29

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Users\Admin\AppData\Local\Temp\PI 10287.exe
  "C:\Users\Admin\AppData\Local\Temp\PI 10287.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:2692
- C:\Windows\SysWOW64\iexpress.exe
  "C:\Windows\SysWOW64\iexpress.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1196-18-0x00000000030D0000-0x00000000031D0000-memory.dmp

Filesize
1024KB

Download
memory/1196-21-0x0000000008EF0000-0x00000000093DC000-memory.dmp

Filesize
4.9MB

Download
memory/1196-29-0x0000000008EF0000-0x00000000093DC000-memory.dmp

Filesize
4.9MB

Download
memory/1988-4-0x0000000000510000-0x000000000051C000-memory.dmp

Filesize
48KB

Download
memory/1988-14-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download
memory/1988-5-0x0000000000520000-0x0000000000530000-memory.dmp

Filesize
64KB

Download
memory/1988-6-0x00000000045B0000-0x000000000463A000-memory.dmp

Filesize
552KB

Download
memory/1988-1-0x00000000010F0000-0x00000000011A4000-memory.dmp

Filesize
720KB

Download
memory/1988-2-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download
memory/1988-0-0x00000000745DE000-0x00000000745DF000-memory.dmp

Filesize
4KB

Download
memory/1988-3-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2612-27-0x0000000000080000-0x00000000000BF000-memory.dmp

Filesize
252KB

Download
memory/2612-26-0x00000000021F0000-0x00000000024F3000-memory.dmp

Filesize
3.0MB

Download
memory/2612-23-0x0000000000080000-0x00000000000BF000-memory.dmp

Filesize
252KB

Download
memory/2612-28-0x0000000000760000-0x00000000007FE000-memory.dmp

Filesize
632KB

Download
memory/2612-22-0x0000000000080000-0x00000000000BF000-memory.dmp

Filesize
252KB

Download
memory/2612-30-0x0000000000080000-0x00000000000BF000-memory.dmp

Filesize
252KB

Download
memory/2692-17-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2692-20-0x00000000001F0000-0x000000000020F000-memory.dmp

Filesize
124KB

Download
memory/2692-19-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2692-16-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2692-25-0x00000000001F0000-0x000000000020F000-memory.dmp

Filesize
124KB

Download
memory/2692-24-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2692-15-0x00000000009E0000-0x0000000000CE3000-memory.dmp

Filesize
3.0MB

Download
memory/2692-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2692-13-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2692-9-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2692-7-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download

Analysis

Sharing