457f35de1b15d62282ce17e1d53b2df1a6cea43e1f139012bec66cd5bcc871b9

General

Target

Message_20240703082651_snippa/Message_20240703082651_snippa.wav.exe
Size

2.2MB
MD5

b862a2b99c3968173b3de780bd696027
SHA1

7531769525187639f1530b42f221ad1a9b189a8f
SHA256

e600f4c6b7476c6a87f2cb342b46e0e7b96790c2b25448af030e866b71f2b4b6
SHA512

9bec24ed3dfdb71c8433a8fb2923423c543554e484b77c7a15c344e66d2c840188e0e4f87582a32a00580df4e5cb89d62b54892d3f9b19a671bde668fff5fb8e
SSDEEP

49152:cJuGb6/6D58MO8qA3hRg+Egv9LPb0S7CmeULsPy8x11eIwhmX6c:cJJW/6W8hheEvRPPP3cy6woX6

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

Message_20240703082651_snippa.wav.exe

pid	process
2332	Message_20240703082651_snippa.wav.exe
2332	Message_20240703082651_snippa.wav.exe
2332	Message_20240703082651_snippa.wav.exe
2332	Message_20240703082651_snippa.wav.exe
2332	Message_20240703082651_snippa.wav.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Message_20240703082651_snippa.wav.exe

description pid process

Token: SeDebugPrivilege 2332 Message_20240703082651_snippa.wav.exe

description	pid	process
Token: SeDebugPrivilege	2332	Message_20240703082651_snippa.wav.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

Message_20240703082651_snippa.wav.exe

C:\Users\Admin\AppData\Local\Temp\Message_20240703082651_snippa\Message_20240703082651_snippa.wav.exe
"C:\Users\Admin\AppData\Local\Temp\Message_20240703082651_snippa\Message_20240703082651_snippa.wav.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2332

C:\Users\Admin\AppData\Local\Temp\Message_20240703082651_snippa\Message_20240703082651_snippa.wav.exe
"C:\Users\Admin\AppData\Local\Temp\Message_20240703082651_snippa\Message_20240703082651_snippa.wav.exe"
2⤵
PID:2828

C:\Users\Admin\AppData\Local\Temp\Message_20240703082651_snippa\Message_20240703082651_snippa.wav.exe
"C:\Users\Admin\AppData\Local\Temp\Message_20240703082651_snippa\Message_20240703082651_snippa.wav.exe"
2⤵
PID:2664

C:\Users\Admin\AppData\Local\Temp\Message_20240703082651_snippa\Message_20240703082651_snippa.wav.exe
"C:\Users\Admin\AppData\Local\Temp\Message_20240703082651_snippa\Message_20240703082651_snippa.wav.exe"
2⤵
PID:2672

C:\Users\Admin\AppData\Local\Temp\Message_20240703082651_snippa\Message_20240703082651_snippa.wav.exe
"C:\Users\Admin\AppData\Local\Temp\Message_20240703082651_snippa\Message_20240703082651_snippa.wav.exe"
2⤵
PID:2548

C:\Users\Admin\AppData\Local\Temp\Message_20240703082651_snippa\Message_20240703082651_snippa.wav.exe
"C:\Users\Admin\AppData\Local\Temp\Message_20240703082651_snippa\Message_20240703082651_snippa.wav.exe"
2⤵
PID:1072

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2332-0-0x000000007468E000-0x000000007468F000-memory.dmp

Filesize
4KB

Download
memory/2332-1-0x00000000001E0000-0x000000000040E000-memory.dmp

Filesize
2.2MB

Download
memory/2332-2-0x0000000074680000-0x0000000074D6E000-memory.dmp

Filesize
6.9MB

Download
memory/2332-3-0x0000000002160000-0x000000000217A000-memory.dmp

Filesize
104KB

Download
memory/2332-4-0x0000000002190000-0x0000000002198000-memory.dmp

Filesize
32KB

Download
memory/2332-5-0x00000000021A0000-0x00000000021AC000-memory.dmp

Filesize
48KB

Download
memory/2332-6-0x000000000D730000-0x000000000D906000-memory.dmp

Filesize
1.8MB

Download
memory/2332-7-0x000000007468E000-0x000000007468F000-memory.dmp

Filesize
4KB

Download
memory/2332-8-0x0000000074680000-0x0000000074D6E000-memory.dmp

Filesize
6.9MB

Download
memory/2332-9-0x0000000074680000-0x0000000074D6E000-memory.dmp

Filesize
6.9MB

Download

description	pid	process	target process
PID 2332 wrote to memory of 2828	2332	Message_20240703082651_snippa.wav.exe	Message_20240703082651_snippa.wav.exe
PID 2332 wrote to memory of 2828	2332	Message_20240703082651_snippa.wav.exe	Message_20240703082651_snippa.wav.exe
PID 2332 wrote to memory of 2828	2332	Message_20240703082651_snippa.wav.exe	Message_20240703082651_snippa.wav.exe
PID 2332 wrote to memory of 2828	2332	Message_20240703082651_snippa.wav.exe	Message_20240703082651_snippa.wav.exe
PID 2332 wrote to memory of 2664	2332	Message_20240703082651_snippa.wav.exe	Message_20240703082651_snippa.wav.exe
PID 2332 wrote to memory of 2664	2332	Message_20240703082651_snippa.wav.exe	Message_20240703082651_snippa.wav.exe
PID 2332 wrote to memory of 2664	2332	Message_20240703082651_snippa.wav.exe	Message_20240703082651_snippa.wav.exe
PID 2332 wrote to memory of 2664	2332	Message_20240703082651_snippa.wav.exe	Message_20240703082651_snippa.wav.exe
PID 2332 wrote to memory of 2672	2332	Message_20240703082651_snippa.wav.exe	Message_20240703082651_snippa.wav.exe
PID 2332 wrote to memory of 2672	2332	Message_20240703082651_snippa.wav.exe	Message_20240703082651_snippa.wav.exe
PID 2332 wrote to memory of 2672	2332	Message_20240703082651_snippa.wav.exe	Message_20240703082651_snippa.wav.exe
PID 2332 wrote to memory of 2672	2332	Message_20240703082651_snippa.wav.exe	Message_20240703082651_snippa.wav.exe
PID 2332 wrote to memory of 2548	2332	Message_20240703082651_snippa.wav.exe	Message_20240703082651_snippa.wav.exe
PID 2332 wrote to memory of 2548	2332	Message_20240703082651_snippa.wav.exe	Message_20240703082651_snippa.wav.exe
PID 2332 wrote to memory of 2548	2332	Message_20240703082651_snippa.wav.exe	Message_20240703082651_snippa.wav.exe
PID 2332 wrote to memory of 2548	2332	Message_20240703082651_snippa.wav.exe	Message_20240703082651_snippa.wav.exe
PID 2332 wrote to memory of 1072	2332	Message_20240703082651_snippa.wav.exe	Message_20240703082651_snippa.wav.exe
PID 2332 wrote to memory of 1072	2332	Message_20240703082651_snippa.wav.exe	Message_20240703082651_snippa.wav.exe
PID 2332 wrote to memory of 1072	2332	Message_20240703082651_snippa.wav.exe	Message_20240703082651_snippa.wav.exe
PID 2332 wrote to memory of 1072	2332	Message_20240703082651_snippa.wav.exe	Message_20240703082651_snippa.wav.exe

Analysis

Sharing