f761d87cea888c09206e10627d8de9da113ed934d0f4f88f9d25384df0afd015 | Triage

Analysis

max time kernel
125s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09-07-2024 11:55

Sharing

Report Analysis Logs

General

Target

cv.exe
Size

544KB
MD5

17954e24dc5a85c3d107b46e1250cc12
SHA1

3c40842922857c46586a394e536aa503a94a4257
SHA256

729f127be9398f24063555026eb9979bc3c49554caf0ac221aafbd87faf74037
SHA512

9d3aa9143d7f9519ed2a3b148a4c92f89c54c50f5a3025d53768a56fdafd094bee6228f05991568f9e07a72e65245cb6b5efbdff6a38eb144218f7714fe28617
SSDEEP

12288:HnDmDhpuQj91cbYeChYgG10tJQuvtcRbnu7O:HnDmZ9BeChYgG10tJQkwbnKO

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cv.exe

description pid process target process

PID 4752 wrote to memory of 2336 4752 cv.exe getmac.exe
PID 4752 wrote to memory of 2336 4752 cv.exe getmac.exe

C:\Users\Admin\AppData\Local\Temp\cv.exe
"C:\Users\Admin\AppData\Local\Temp\cv.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4752

\??\c:\windows\System32\getmac.exe
getmac /s service.1c-report.com /fo table /nh /v
2⤵
PID:2336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4100,i,18261153038209191383,10347744459236715365,262144 --variations-seed-version --mojo-platform-channel-handle=4020 /prefetch:8
1⤵
PID:1572

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...