457f35de1b15d62282ce17e1d53b2df1a6cea43e1f139012bec66cd5bcc871b9

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 03:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Message_20240703082651_snippa/Message_20240703082651_snippa.wav.exe
Size

2.2MB
MD5

b862a2b99c3968173b3de780bd696027
SHA1

7531769525187639f1530b42f221ad1a9b189a8f
SHA256

e600f4c6b7476c6a87f2cb342b46e0e7b96790c2b25448af030e866b71f2b4b6
SHA512

9bec24ed3dfdb71c8433a8fb2923423c543554e484b77c7a15c344e66d2c840188e0e4f87582a32a00580df4e5cb89d62b54892d3f9b19a671bde668fff5fb8e
SSDEEP

49152:cJuGb6/6D58MO8qA3hRg+Egv9LPb0S7CmeULsPy8x11eIwhmX6c:cJJW/6W8hheEvRPPP3cy6woX6

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2332	Message_20240703082651_snippa.wav.exe
2332	Message_20240703082651_snippa.wav.exe
2332	Message_20240703082651_snippa.wav.exe
2332	Message_20240703082651_snippa.wav.exe
2332	Message_20240703082651_snippa.wav.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2332	Message_20240703082651_snippa.wav.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 2828	2332	Message_20240703082651_snippa.wav.exe	28
PID 2332 wrote to memory of 2828	2332	Message_20240703082651_snippa.wav.exe	28
PID 2332 wrote to memory of 2828	2332	Message_20240703082651_snippa.wav.exe	28
PID 2332 wrote to memory of 2828	2332	Message_20240703082651_snippa.wav.exe	28
PID 2332 wrote to memory of 2664	2332	Message_20240703082651_snippa.wav.exe	29
PID 2332 wrote to memory of 2664	2332	Message_20240703082651_snippa.wav.exe	29
PID 2332 wrote to memory of 2664	2332	Message_20240703082651_snippa.wav.exe	29
PID 2332 wrote to memory of 2664	2332	Message_20240703082651_snippa.wav.exe	29
PID 2332 wrote to memory of 2672	2332	Message_20240703082651_snippa.wav.exe	30
PID 2332 wrote to memory of 2672	2332	Message_20240703082651_snippa.wav.exe	30
PID 2332 wrote to memory of 2672	2332	Message_20240703082651_snippa.wav.exe	30
PID 2332 wrote to memory of 2672	2332	Message_20240703082651_snippa.wav.exe	30
PID 2332 wrote to memory of 2548	2332	Message_20240703082651_snippa.wav.exe	31
PID 2332 wrote to memory of 2548	2332	Message_20240703082651_snippa.wav.exe	31
PID 2332 wrote to memory of 2548	2332	Message_20240703082651_snippa.wav.exe	31
PID 2332 wrote to memory of 2548	2332	Message_20240703082651_snippa.wav.exe	31
PID 2332 wrote to memory of 1072	2332	Message_20240703082651_snippa.wav.exe	32
PID 2332 wrote to memory of 1072	2332	Message_20240703082651_snippa.wav.exe	32
PID 2332 wrote to memory of 1072	2332	Message_20240703082651_snippa.wav.exe	32
PID 2332 wrote to memory of 1072	2332	Message_20240703082651_snippa.wav.exe	32

C:\Users\Admin\AppData\Local\Temp\Message_20240703082651_snippa\Message_20240703082651_snippa.wav.exe
"C:\Users\Admin\AppData\Local\Temp\Message_20240703082651_snippa\Message_20240703082651_snippa.wav.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Users\Admin\AppData\Local\Temp\Message_20240703082651_snippa\Message_20240703082651_snippa.wav.exe
  "C:\Users\Admin\AppData\Local\Temp\Message_20240703082651_snippa\Message_20240703082651_snippa.wav.exe"
  2⤵
  PID:2828
- C:\Users\Admin\AppData\Local\Temp\Message_20240703082651_snippa\Message_20240703082651_snippa.wav.exe
  "C:\Users\Admin\AppData\Local\Temp\Message_20240703082651_snippa\Message_20240703082651_snippa.wav.exe"
  2⤵
  PID:2664
- C:\Users\Admin\AppData\Local\Temp\Message_20240703082651_snippa\Message_20240703082651_snippa.wav.exe
  "C:\Users\Admin\AppData\Local\Temp\Message_20240703082651_snippa\Message_20240703082651_snippa.wav.exe"
  2⤵
  PID:2672
- C:\Users\Admin\AppData\Local\Temp\Message_20240703082651_snippa\Message_20240703082651_snippa.wav.exe
  "C:\Users\Admin\AppData\Local\Temp\Message_20240703082651_snippa\Message_20240703082651_snippa.wav.exe"
  2⤵
  PID:2548
- C:\Users\Admin\AppData\Local\Temp\Message_20240703082651_snippa\Message_20240703082651_snippa.wav.exe
  "C:\Users\Admin\AppData\Local\Temp\Message_20240703082651_snippa\Message_20240703082651_snippa.wav.exe"
  2⤵
  PID:1072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2332-0-0x000000007468E000-0x000000007468F000-memory.dmp

Filesize
4KB

Download
memory/2332-1-0x00000000001E0000-0x000000000040E000-memory.dmp

Filesize
2.2MB

Download
memory/2332-2-0x0000000074680000-0x0000000074D6E000-memory.dmp

Filesize
6.9MB

Download
memory/2332-3-0x0000000002160000-0x000000000217A000-memory.dmp

Filesize
104KB

Download
memory/2332-4-0x0000000002190000-0x0000000002198000-memory.dmp

Filesize
32KB

Download
memory/2332-5-0x00000000021A0000-0x00000000021AC000-memory.dmp

Filesize
48KB

Download
memory/2332-6-0x000000000D730000-0x000000000D906000-memory.dmp

Filesize
1.8MB

Download
memory/2332-7-0x000000007468E000-0x000000007468F000-memory.dmp

Filesize
4KB

Download
memory/2332-8-0x0000000074680000-0x0000000074D6E000-memory.dmp

Filesize
6.9MB

Download
memory/2332-9-0x0000000074680000-0x0000000074D6E000-memory.dmp

Filesize
6.9MB

Download