Analysis

  • max time kernel
    146s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    03-06-2024 13:28

General

  • Target

    Scanned Documents.exe

  • Size

    892KB

  • MD5

    92897efceeadf53315a22b740f20e1e5

  • SHA1

    1fb78617996b7d1d7cd5715620c03a51284b6312

  • SHA256

    5e0b09d1ef168d8efae50bf55632e623cc5bcda27cc27dea384cd90fbef373a4

  • SHA512

    19f88ea4579dce1322a02b969f90a978f25111373509ee281854e158aa877c13857a836ff73206e919babc407e352bc554dda7c4b981aa3cd5caab4bfb4f98fe

  • SSDEEP

    24576:EMYewzKiN5imjB5ZeBeuAZQ8WlFW6OUyayyq7rjBB+:EMYeYN5imjBC07ZQ8iFWsy0q7m

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:1196
    • C:\Users\Admin\AppData\Local\Temp\Scanned Documents.exe
      "C:\Users\Admin\AppData\Local\Temp\Scanned Documents.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2464
      • C:\Users\Admin\AppData\Local\Temp\Scanned Documents.exe
        "C:\Users\Admin\AppData\Local\Temp\Scanned Documents.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        PID:2668
    • C:\Windows\SysWOW64\DWWIN.EXE
      "C:\Windows\SysWOW64\DWWIN.EXE"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:1516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar1453.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • memory/1196-116-0x0000000002F30000-0x0000000003030000-memory.dmp

    Filesize

    1024KB

  • memory/1196-122-0x0000000008CD0000-0x000000000BF1D000-memory.dmp

    Filesize

    50.3MB

  • memory/1196-117-0x0000000008CD0000-0x000000000BF1D000-memory.dmp

    Filesize

    50.3MB

  • memory/1516-121-0x0000000000080000-0x00000000000BF000-memory.dmp

    Filesize

    252KB

  • memory/1516-118-0x0000000000080000-0x00000000000BF000-memory.dmp

    Filesize

    252KB

  • memory/2464-110-0x0000000074680000-0x0000000074D6E000-memory.dmp

    Filesize

    6.9MB

  • memory/2464-101-0x0000000000A90000-0x0000000000A9E000-memory.dmp

    Filesize

    56KB

  • memory/2464-1-0x0000000000C40000-0x0000000000D20000-memory.dmp

    Filesize

    896KB

  • memory/2464-9-0x0000000074680000-0x0000000074D6E000-memory.dmp

    Filesize

    6.9MB

  • memory/2464-100-0x0000000000650000-0x0000000000666000-memory.dmp

    Filesize

    88KB

  • memory/2464-0-0x000000007468E000-0x000000007468F000-memory.dmp

    Filesize

    4KB

  • memory/2464-103-0x0000000005B40000-0x0000000005BCA000-memory.dmp

    Filesize

    552KB

  • memory/2464-102-0x0000000000BA0000-0x0000000000BB0000-memory.dmp

    Filesize

    64KB

  • memory/2668-112-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2668-113-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2668-114-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2668-115-0x0000000000450000-0x0000000000470000-memory.dmp

    Filesize

    128KB

  • memory/2668-111-0x0000000000720000-0x0000000000A23000-memory.dmp

    Filesize

    3.0MB

  • memory/2668-104-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2668-109-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2668-120-0x0000000000450000-0x0000000000470000-memory.dmp

    Filesize

    128KB

  • memory/2668-119-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2668-105-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2668-106-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB