462999449c5bea90e22e4f8c4a23c7f9aa96b9686e9ab1bcba076cca139637ac

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 01:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ADELJ-80-PI-MRQ-1399-0003-2.scr
Size

1020KB
MD5

798aac842f0982d68900dabf85277122
SHA1

afc573a93cf395891e943ecd528fb623306785f4
SHA256

5026667da06595a547008ed53d4497871f944b195e087aabaf2d94b378b5a99a
SHA512

c7ef85f128e6efa4204e24375628d05adb74b75356bc14988d4cf3bd404da1be08c5cfec2856bb10359c0a0917af56ed994b738d5dffd9f2c75283fa0c558b46
SSDEEP

12288:7vSQ9H6i4jKmskO4uZPkSAYYCdXEOwk7mcv16No6FFzKPbjgMuCe3Cfc81J5kR:TRKoZP7AYYCRwADAVCwMuCe3CBk

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3016 set thread context of 2724	3016	ADELJ-80-PI-MRQ-1399-0003-2.scr	32
PID 2724 set thread context of 1200	2724	ADELJ-80-PI-MRQ-1399-0003-2.scr	21
PID 2724 set thread context of 2108	2724	ADELJ-80-PI-MRQ-1399-0003-2.scr	35
PID 2108 set thread context of 1200	2108	w32tm.exe	21

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
3016	ADELJ-80-PI-MRQ-1399-0003-2.scr
3016	ADELJ-80-PI-MRQ-1399-0003-2.scr
3016	ADELJ-80-PI-MRQ-1399-0003-2.scr
3016	ADELJ-80-PI-MRQ-1399-0003-2.scr
2724	ADELJ-80-PI-MRQ-1399-0003-2.scr
2724	ADELJ-80-PI-MRQ-1399-0003-2.scr
2724	ADELJ-80-PI-MRQ-1399-0003-2.scr
2724	ADELJ-80-PI-MRQ-1399-0003-2.scr
2724	ADELJ-80-PI-MRQ-1399-0003-2.scr
2724	ADELJ-80-PI-MRQ-1399-0003-2.scr
2724	ADELJ-80-PI-MRQ-1399-0003-2.scr
2724	ADELJ-80-PI-MRQ-1399-0003-2.scr
2108	w32tm.exe
2108	w32tm.exe
2108	w32tm.exe
2108	w32tm.exe
2108	w32tm.exe
2108	w32tm.exe
2108	w32tm.exe
2108	w32tm.exe
2108	w32tm.exe
2108	w32tm.exe
2108	w32tm.exe
2108	w32tm.exe
2108	w32tm.exe
2108	w32tm.exe
2108	w32tm.exe
2108	w32tm.exe
2108	w32tm.exe
2108	w32tm.exe
2108	w32tm.exe
2108	w32tm.exe
2108	w32tm.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2724	ADELJ-80-PI-MRQ-1399-0003-2.scr
1200	Explorer.EXE
1200	Explorer.EXE
2108	w32tm.exe
2108	w32tm.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3016	ADELJ-80-PI-MRQ-1399-0003-2.scr

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2136	3016	ADELJ-80-PI-MRQ-1399-0003-2.scr	28
PID 3016 wrote to memory of 2136	3016	ADELJ-80-PI-MRQ-1399-0003-2.scr	28
PID 3016 wrote to memory of 2136	3016	ADELJ-80-PI-MRQ-1399-0003-2.scr	28
PID 3016 wrote to memory of 2136	3016	ADELJ-80-PI-MRQ-1399-0003-2.scr	28
PID 3016 wrote to memory of 2152	3016	ADELJ-80-PI-MRQ-1399-0003-2.scr	29
PID 3016 wrote to memory of 2152	3016	ADELJ-80-PI-MRQ-1399-0003-2.scr	29
PID 3016 wrote to memory of 2152	3016	ADELJ-80-PI-MRQ-1399-0003-2.scr	29
PID 3016 wrote to memory of 2152	3016	ADELJ-80-PI-MRQ-1399-0003-2.scr	29
PID 3016 wrote to memory of 2668	3016	ADELJ-80-PI-MRQ-1399-0003-2.scr	30
PID 3016 wrote to memory of 2668	3016	ADELJ-80-PI-MRQ-1399-0003-2.scr	30
PID 3016 wrote to memory of 2668	3016	ADELJ-80-PI-MRQ-1399-0003-2.scr	30
PID 3016 wrote to memory of 2668	3016	ADELJ-80-PI-MRQ-1399-0003-2.scr	30
PID 3016 wrote to memory of 2680	3016	ADELJ-80-PI-MRQ-1399-0003-2.scr	31
PID 3016 wrote to memory of 2680	3016	ADELJ-80-PI-MRQ-1399-0003-2.scr	31
PID 3016 wrote to memory of 2680	3016	ADELJ-80-PI-MRQ-1399-0003-2.scr	31
PID 3016 wrote to memory of 2680	3016	ADELJ-80-PI-MRQ-1399-0003-2.scr	31
PID 3016 wrote to memory of 2724	3016	ADELJ-80-PI-MRQ-1399-0003-2.scr	32
PID 3016 wrote to memory of 2724	3016	ADELJ-80-PI-MRQ-1399-0003-2.scr	32
PID 3016 wrote to memory of 2724	3016	ADELJ-80-PI-MRQ-1399-0003-2.scr	32
PID 3016 wrote to memory of 2724	3016	ADELJ-80-PI-MRQ-1399-0003-2.scr	32
PID 3016 wrote to memory of 2724	3016	ADELJ-80-PI-MRQ-1399-0003-2.scr	32
PID 3016 wrote to memory of 2724	3016	ADELJ-80-PI-MRQ-1399-0003-2.scr	32
PID 3016 wrote to memory of 2724	3016	ADELJ-80-PI-MRQ-1399-0003-2.scr	32
PID 1200 wrote to memory of 2108	1200	Explorer.EXE	35
PID 1200 wrote to memory of 2108	1200	Explorer.EXE	35
PID 1200 wrote to memory of 2108	1200	Explorer.EXE	35
PID 1200 wrote to memory of 2108	1200	Explorer.EXE	35

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Users\Admin\AppData\Local\Temp\ADELJ-80-PI-MRQ-1399-0003-2.scr
  "C:\Users\Admin\AppData\Local\Temp\ADELJ-80-PI-MRQ-1399-0003-2.scr" /S
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Users\Admin\AppData\Local\Temp\ADELJ-80-PI-MRQ-1399-0003-2.scr
    "C:\Users\Admin\AppData\Local\Temp\ADELJ-80-PI-MRQ-1399-0003-2.scr"
    3⤵
    PID:2136
- - C:\Users\Admin\AppData\Local\Temp\ADELJ-80-PI-MRQ-1399-0003-2.scr
    "C:\Users\Admin\AppData\Local\Temp\ADELJ-80-PI-MRQ-1399-0003-2.scr"
    3⤵
    PID:2152
- - C:\Users\Admin\AppData\Local\Temp\ADELJ-80-PI-MRQ-1399-0003-2.scr
    "C:\Users\Admin\AppData\Local\Temp\ADELJ-80-PI-MRQ-1399-0003-2.scr"
    3⤵
    PID:2668
- - C:\Users\Admin\AppData\Local\Temp\ADELJ-80-PI-MRQ-1399-0003-2.scr
    "C:\Users\Admin\AppData\Local\Temp\ADELJ-80-PI-MRQ-1399-0003-2.scr"
    3⤵
    PID:2680
- - C:\Users\Admin\AppData\Local\Temp\ADELJ-80-PI-MRQ-1399-0003-2.scr
    "C:\Users\Admin\AppData\Local\Temp\ADELJ-80-PI-MRQ-1399-0003-2.scr"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:2724
- C:\Windows\SysWOW64\w32tm.exe
  "C:\Windows\SysWOW64\w32tm.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1200-18-0x0000000003C20000-0x0000000003D20000-memory.dmp

Filesize
1024KB

Download
memory/1200-29-0x0000000009100000-0x0000000009EC6000-memory.dmp

Filesize
13.8MB

Download
memory/1200-21-0x0000000009100000-0x0000000009EC6000-memory.dmp

Filesize
13.8MB

Download
memory/2108-30-0x0000000000080000-0x00000000000BF000-memory.dmp

Filesize
252KB

Download
memory/2108-28-0x0000000002400000-0x00000000024A0000-memory.dmp

Filesize
640KB

Download
memory/2108-27-0x0000000000080000-0x00000000000BF000-memory.dmp

Filesize
252KB

Download
memory/2108-26-0x0000000002050000-0x0000000002353000-memory.dmp

Filesize
3.0MB

Download
memory/2108-23-0x0000000000080000-0x00000000000BF000-memory.dmp

Filesize
252KB

Download
memory/2108-22-0x0000000000080000-0x00000000000BF000-memory.dmp

Filesize
252KB

Download
memory/2724-15-0x0000000000A00000-0x0000000000D03000-memory.dmp

Filesize
3.0MB

Download
memory/2724-8-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2724-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2724-13-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2724-24-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2724-25-0x00000000003C0000-0x00000000003E1000-memory.dmp

Filesize
132KB

Download
memory/2724-16-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2724-17-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2724-19-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2724-20-0x00000000003C0000-0x00000000003E1000-memory.dmp

Filesize
132KB

Download
memory/2724-9-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2724-12-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3016-7-0x00000000055E0000-0x000000000566A000-memory.dmp

Filesize
552KB

Download
memory/3016-6-0x00000000050C0000-0x000000000515A000-memory.dmp

Filesize
616KB

Download
memory/3016-0-0x0000000073EFE000-0x0000000073EFF000-memory.dmp

Filesize
4KB

Download
memory/3016-14-0x0000000073EF0000-0x00000000745DE000-memory.dmp

Filesize
6.9MB

Download
memory/3016-4-0x0000000000850000-0x0000000000858000-memory.dmp

Filesize
32KB

Download
memory/3016-5-0x0000000001EF0000-0x0000000001EFC000-memory.dmp

Filesize
48KB

Download
memory/3016-3-0x00000000005A0000-0x00000000005B2000-memory.dmp

Filesize
72KB

Download
memory/3016-2-0x0000000073EF0000-0x00000000745DE000-memory.dmp

Filesize
6.9MB

Download
memory/3016-1-0x0000000000090000-0x0000000000192000-memory.dmp

Filesize
1.0MB

Download