Analysis
- max time kernel
142s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
02/07/2024, 05:54
General
- Target New Inquiry CAD.scr.exe
- Size 16KB
- Sample240702-glw2rasgpm
- SHA256 e9fa79c4d1eb54c11dd2b8b575ea7fb6136c9a2b70f419325dd129be13ef53b7
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Inquiry CAD.scr.exe"C:\Users\Admin\AppData\Local\Temp\New Inquiry CAD.scr.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\New Inquiry CAD.scr.exe"C:\Users\Admin\AppData\Local\Temp\New Inquiry CAD.scr.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
New Inquiry CAD.scr.exe.log
memory/1588-0-0x00000000750EE000-0x00000000750EF000-memory.dmp
memory/1588-1-0x00000000008E0000-0x00000000008EA000-memory.dmp
memory/1588-2-0x00000000750E0000-0x0000000075890000-memory.dmp
memory/1588-3-0x00000000077A0000-0x0000000007A88000-memory.dmp
memory/1588-4-0x0000000008080000-0x0000000008624000-memory.dmp
memory/1588-5-0x0000000007CD0000-0x0000000007D62000-memory.dmp
memory/1588-6-0x00000000077A0000-0x0000000007A83000-memory.dmp
memory/1588-19-0x00000000077A0000-0x0000000007A83000-memory.dmp
memory/1588-21-0x00000000077A0000-0x0000000007A83000-memory.dmp
memory/1588-43-0x00000000077A0000-0x0000000007A83000-memory.dmp
memory/1588-41-0x00000000077A0000-0x0000000007A83000-memory.dmp
memory/1588-49-0x00000000077A0000-0x0000000007A83000-memory.dmp
memory/1588-57-0x00000000077A0000-0x0000000007A83000-memory.dmp
memory/1588-65-0x00000000077A0000-0x0000000007A83000-memory.dmp
memory/1588-63-0x00000000077A0000-0x0000000007A83000-memory.dmp
memory/1588-61-0x00000000077A0000-0x0000000007A83000-memory.dmp
memory/1588-59-0x00000000077A0000-0x0000000007A83000-memory.dmp
memory/1588-55-0x00000000077A0000-0x0000000007A83000-memory.dmp
memory/1588-53-0x00000000077A0000-0x0000000007A83000-memory.dmp
memory/1588-52-0x00000000077A0000-0x0000000007A83000-memory.dmp
memory/1588-47-0x00000000077A0000-0x0000000007A83000-memory.dmp
memory/1588-45-0x00000000077A0000-0x0000000007A83000-memory.dmp
memory/1588-39-0x00000000077A0000-0x0000000007A83000-memory.dmp
memory/1588-35-0x00000000077A0000-0x0000000007A83000-memory.dmp
memory/1588-33-0x00000000077A0000-0x0000000007A83000-memory.dmp
memory/1588-31-0x00000000077A0000-0x0000000007A83000-memory.dmp
memory/1588-29-0x00000000077A0000-0x0000000007A83000-memory.dmp
memory/1588-37-0x00000000077A0000-0x0000000007A83000-memory.dmp
memory/1588-27-0x00000000077A0000-0x0000000007A83000-memory.dmp
memory/1588-25-0x00000000077A0000-0x0000000007A83000-memory.dmp
memory/1588-23-0x00000000077A0000-0x0000000007A83000-memory.dmp
memory/1588-17-0x00000000077A0000-0x0000000007A83000-memory.dmp
memory/1588-15-0x00000000077A0000-0x0000000007A83000-memory.dmp
memory/1588-13-0x00000000077A0000-0x0000000007A83000-memory.dmp
memory/1588-12-0x00000000077A0000-0x0000000007A83000-memory.dmp
memory/1588-9-0x00000000077A0000-0x0000000007A83000-memory.dmp
memory/1588-7-0x00000000077A0000-0x0000000007A83000-memory.dmp
memory/1588-69-0x00000000077A0000-0x0000000007A83000-memory.dmp
memory/1588-67-0x00000000077A0000-0x0000000007A83000-memory.dmp
memory/1588-4868-0x00000000750E0000-0x0000000075890000-memory.dmp
memory/1588-4869-0x0000000005BB0000-0x0000000005CD6000-memory.dmp
memory/1588-4870-0x0000000002BF0000-0x0000000002C3C000-memory.dmp
memory/1588-4871-0x00000000750EE000-0x00000000750EF000-memory.dmp
memory/1588-4872-0x00000000750E0000-0x0000000075890000-memory.dmp
memory/1588-4873-0x0000000005B00000-0x0000000005B54000-memory.dmp
memory/1588-4879-0x00000000750E0000-0x0000000075890000-memory.dmp
memory/3264-4878-0x0000000000500000-0x00000000005D6000-memory.dmp
memory/3264-4881-0x00000000750E0000-0x0000000075890000-memory.dmp
memory/3264-4880-0x0000000004AC0000-0x0000000004BCE000-memory.dmp
memory/3264-4983-0x00000000750E0000-0x0000000075890000-memory.dmp
memory/3264-7725-0x0000000004CA0000-0x0000000004D3E000-memory.dmp
memory/3264-7726-0x00000000750E0000-0x0000000075890000-memory.dmp