cd05700b5fa43cd11f8f5763bc9340b8f8ee40cdc64765cb604ab28ee68a1d0f

Analysis

max time kernel
149s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/06/2024, 06:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
288292021 ABB.exe
Size 653KB
Sample240626-g4wtpsseqq
SHA256 cd05700b5fa43cd11f8f5763bc9340b8f8ee40cdc64765cb604ab28ee68a1d0f
MD5 c64325f3924df53a207cfb0c16355279
SHA1 a9ca74cd5eed6a98bbb9742356e2813ec690e369
SHA512 7ba9aa7652282148a8de132f875beccdd69456bc7699f5332fe687accbe3b309ca8194469237abe020ab7d8da0c07959f683908a7d8ed4d1386e62ff9f9d2787
SSDEEP 12288:Bvu0rpO3D6kYlVKq0gjSc8N8qvd9zQuwtKn22RkR:5xN0D6vkuqN8V8M
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2748 set thread context of 2208	2748	288292021 ABB.exe	102
PID 2208 set thread context of 3360	2208	288292021 ABB.exe	57
PID 2208 set thread context of 3468	2208	288292021 ABB.exe	103
PID 3468 set thread context of 3360	3468	w32tm.exe	57

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
2748	288292021 ABB.exe
2748	288292021 ABB.exe
2208	288292021 ABB.exe
2208	288292021 ABB.exe
2208	288292021 ABB.exe
2208	288292021 ABB.exe
2208	288292021 ABB.exe
2208	288292021 ABB.exe
2208	288292021 ABB.exe
2208	288292021 ABB.exe
2208	288292021 ABB.exe
2208	288292021 ABB.exe
2208	288292021 ABB.exe
2208	288292021 ABB.exe
2208	288292021 ABB.exe
2208	288292021 ABB.exe
2208	288292021 ABB.exe
2208	288292021 ABB.exe
2208	288292021 ABB.exe
2208	288292021 ABB.exe
2208	288292021 ABB.exe
3468	w32tm.exe
3468	w32tm.exe
3468	w32tm.exe
3468	w32tm.exe
3468	w32tm.exe
3468	w32tm.exe
3468	w32tm.exe
3468	w32tm.exe
3468	w32tm.exe
3468	w32tm.exe
3468	w32tm.exe
3468	w32tm.exe
3468	w32tm.exe
3468	w32tm.exe
3468	w32tm.exe
3468	w32tm.exe
3468	w32tm.exe
3468	w32tm.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2208	288292021 ABB.exe
3360	Explorer.EXE
3360	Explorer.EXE
3468	w32tm.exe
3468	w32tm.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2748	288292021 ABB.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 4660	2748	288292021 ABB.exe	101
PID 2748 wrote to memory of 4660	2748	288292021 ABB.exe	101
PID 2748 wrote to memory of 4660	2748	288292021 ABB.exe	101
PID 2748 wrote to memory of 2208	2748	288292021 ABB.exe	102
PID 2748 wrote to memory of 2208	2748	288292021 ABB.exe	102
PID 2748 wrote to memory of 2208	2748	288292021 ABB.exe	102
PID 2748 wrote to memory of 2208	2748	288292021 ABB.exe	102
PID 2748 wrote to memory of 2208	2748	288292021 ABB.exe	102
PID 2748 wrote to memory of 2208	2748	288292021 ABB.exe	102
PID 3360 wrote to memory of 3468	3360	Explorer.EXE	103
PID 3360 wrote to memory of 3468	3360	Explorer.EXE	103
PID 3360 wrote to memory of 3468	3360	Explorer.EXE	103

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3360
- C:\Users\Admin\AppData\Local\Temp\288292021 ABB.exe
  "C:\Users\Admin\AppData\Local\Temp\288292021 ABB.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Users\Admin\AppData\Local\Temp\288292021 ABB.exe
    "C:\Users\Admin\AppData\Local\Temp\288292021 ABB.exe"
    3⤵
    PID:4660
- - C:\Users\Admin\AppData\Local\Temp\288292021 ABB.exe
    "C:\Users\Admin\AppData\Local\Temp\288292021 ABB.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:2208
- C:\Windows\SysWOW64\w32tm.exe
  "C:\Windows\SysWOW64\w32tm.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:3468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3704 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:1020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2208-14-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2208-25-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2208-26-0x0000000001430000-0x0000000001451000-memory.dmp

Download

memory/2208-20-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2208-21-0x0000000001430000-0x0000000001451000-memory.dmp

Download

memory/2208-19-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2208-18-0x0000000001760000-0x0000000001AAA000-memory.dmp

Download

memory/2208-17-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2748-7-0x0000000005030000-0x00000000050CC000-memory.dmp

Download

memory/2748-4-0x0000000074DD0000-0x0000000075580000-memory.dmp

Download

memory/2748-10-0x0000000074DDE000-0x0000000074DDF000-memory.dmp

Download

memory/2748-11-0x0000000005350000-0x000000000535C000-memory.dmp

Download

memory/2748-12-0x00000000065E0000-0x000000000666A000-memory.dmp

Download

memory/2748-13-0x0000000074DD0000-0x0000000075580000-memory.dmp

Download

memory/2748-8-0x00000000050D0000-0x0000000005170000-memory.dmp

Download

memory/2748-16-0x0000000074DD0000-0x0000000075580000-memory.dmp

Download

memory/2748-0-0x0000000074DDE000-0x0000000074DDF000-memory.dmp

Download

memory/2748-6-0x0000000005EA0000-0x00000000063CC000-memory.dmp

Download

memory/2748-5-0x0000000004F20000-0x0000000004F2A000-memory.dmp

Download

memory/2748-9-0x0000000005310000-0x0000000005320000-memory.dmp

Download

memory/2748-3-0x0000000004D60000-0x0000000004DF2000-memory.dmp

Download

memory/2748-1-0x00000000002D0000-0x0000000000376000-memory.dmp

Download

memory/2748-2-0x00000000053C0000-0x0000000005964000-memory.dmp

Download

memory/3360-22-0x000000000D0C0000-0x000000000F920000-memory.dmp

Download

memory/3360-30-0x000000000D0C0000-0x000000000F920000-memory.dmp

Download

memory/3468-24-0x0000000000620000-0x000000000065F000-memory.dmp

Download

memory/3468-23-0x0000000000620000-0x000000000065F000-memory.dmp

Download

memory/3468-27-0x0000000001030000-0x000000000137A000-memory.dmp

Download

memory/3468-28-0x0000000000620000-0x000000000065F000-memory.dmp

Download

memory/3468-29-0x0000000000DB0000-0x0000000000E50000-memory.dmp

Download

memory/3468-31-0x0000000000620000-0x000000000065F000-memory.dmp

Download