22613505c3fea6ac505f3ed2c8e0df9998331832f405fbba4f9f5a48de753055

Resubmissions

09-07-2024 23:06

240709-23vv8stamd 5

09-07-2024 23:05

240709-223vfs1erp 5

09-07-2024 22:37

240709-2jv2wszepm 10

Analysis

max time kernel
36s
max time network
18s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 23:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

!ŞetUp_64851--#PaSꞨKḙy#$$/Setup.exe
Size

12.0MB
MD5

a7118dffeac3772076f1a39a364d608d
SHA1

6b984d9446f23579e154ec47437b9cf820fd6b67
SHA256

f1973746ac0a703b23526f68c639436f0b26b0bc71c4f5adf36dc5f6e8a7f4d0
SHA512

f547c13b78acda9ca0523f0f8cd966c906f70a23a266ac86156dc7e17e6349e5f506366787e7a7823e2b07b0d614c9bd08e34ca5cc4f48799b0fe36ac836e890
SSDEEP

98304:ReAtQzKADvk/9TEaImN9/tiHBIn8c3hCEFRUTaZnPZOtXwH:ReAOWOM/FE1mNHiFc3hr7UTaZnhOtXwH

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2784 set thread context of 2776	2784	Setup.exe	30

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2784	Setup.exe
2784	Setup.exe
2776	more.com
2776	more.com

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2784	Setup.exe
2776	more.com

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2776	2784	Setup.exe	30
PID 2784 wrote to memory of 2776	2784	Setup.exe	30
PID 2784 wrote to memory of 2776	2784	Setup.exe	30
PID 2784 wrote to memory of 2776	2784	Setup.exe	30
PID 2784 wrote to memory of 2776	2784	Setup.exe	30
PID 2776 wrote to memory of 2804	2776	more.com	32
PID 2776 wrote to memory of 2804	2776	more.com	32
PID 2776 wrote to memory of 2804	2776	more.com	32
PID 2776 wrote to memory of 2804	2776	more.com	32
PID 2776 wrote to memory of 2804	2776	more.com	32

C:\Users\Admin\AppData\Local\Temp\!ŞetUp_64851--#PaSꞨKḙy#$$\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\!ŞetUp_64851--#PaSꞨKḙy#$$\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\SysWOW64\more.com
  C:\Windows\SysWOW64\more.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Windows\SysWOW64\SearchIndexer.exe
    C:\Windows\SysWOW64\SearchIndexer.exe
    3⤵
    PID:2804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\283194c1

Filesize
992KB

MD5
946e6bb05a622c159a4b0dc1129938d4

SHA1
14305f4b8196aa9d3a7a028c69f85e1eb6e40eac

SHA256
8980a7de0a12e800a46b248b67e62473b8da1d67a341651eb983f5ad09f97194

SHA512
20b9505393cf40aa3cadd1fd46ce58f0b4ff50e614feae144f95a3e92fd51f08f983511c0870c91f4d07d32def056699d9fcfefc831a7083ac08d2f7d5663594

Download Submit
memory/2776-13-0x0000000074F0E000-0x0000000074F10000-memory.dmp

Filesize
8KB

Download
memory/2776-21-0x0000000074F0E000-0x0000000074F10000-memory.dmp

Filesize
8KB

Download
memory/2776-16-0x0000000074F00000-0x000000007509D000-memory.dmp

Filesize
1.6MB

Download
memory/2776-14-0x0000000074F00000-0x000000007509D000-memory.dmp

Filesize
1.6MB

Download
memory/2776-12-0x0000000074F00000-0x000000007509D000-memory.dmp

Filesize
1.6MB

Download
memory/2776-11-0x0000000076CB0000-0x0000000076E59000-memory.dmp

Filesize
1.7MB

Download
memory/2784-8-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2784-0-0x000007FEFECF0000-0x000007FEFEEC7000-memory.dmp

Filesize
1.8MB

Download
memory/2784-9-0x000007FEFECF0000-0x000007FEFEEC7000-memory.dmp

Filesize
1.8MB

Download
memory/2784-5-0x000007FEFECF0000-0x000007FEFEEC7000-memory.dmp

Filesize
1.8MB

Download
memory/2784-4-0x000007FEFED08000-0x000007FEFED09000-memory.dmp

Filesize
4KB

Download
memory/2804-17-0x0000000076CB0000-0x0000000076E59000-memory.dmp

Filesize
1.7MB

Download
memory/2804-18-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2804-19-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2804-20-0x000000000022D000-0x0000000000235000-memory.dmp

Filesize
32KB

Download