421b0ef1c2a88cd4748fc910f2ae7ccf92070bc8bf85884282eadb64b1ee78e2

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 05:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

804KB
MD5

231b50057ad6ffccd5144a9b09b6c7ef
SHA1

c690fd7646ed42338113a58c1c373fc55d6aa5b8
SHA256

421b0ef1c2a88cd4748fc910f2ae7ccf92070bc8bf85884282eadb64b1ee78e2
SHA512

dd861316f7294ea53ce1f09c3b444e94decb840359ad98c9449d52ca077e93058c66ba0027b62cbab31b6b6102db7d24517061d85a8873e3f706aabef08388eb
SSDEEP

12288:3Sx14GBK5SYHdZPyhaJm0PoNDNu9H/MLZZTxKO4789RmAz7tlud:3SmSHlNaH/MLZZ9KO4PAvt

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1552 set thread context of 320	1552	file.exe	84
PID 320 set thread context of 3468	320	file.exe	56
PID 320 set thread context of 1524	320	file.exe	86
PID 1524 set thread context of 3468	1524	convert.exe	56

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	convert.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
1552	file.exe
1552	file.exe
320	file.exe
320	file.exe
320	file.exe
320	file.exe
320	file.exe
320	file.exe
320	file.exe
320	file.exe
320	file.exe
320	file.exe
320	file.exe
320	file.exe
320	file.exe
320	file.exe
320	file.exe
320	file.exe
1524	convert.exe
1524	convert.exe
1524	convert.exe
1524	convert.exe
1524	convert.exe
1524	convert.exe
1524	convert.exe
1524	convert.exe
1524	convert.exe
1524	convert.exe
1524	convert.exe
1524	convert.exe
1524	convert.exe
1524	convert.exe
1524	convert.exe
1524	convert.exe
1524	convert.exe
1524	convert.exe
1524	convert.exe
1524	convert.exe
1524	convert.exe
1524	convert.exe
1524	convert.exe
1524	convert.exe
1524	convert.exe
1524	convert.exe
1524	convert.exe
1524	convert.exe
1524	convert.exe
1524	convert.exe
1524	convert.exe
1524	convert.exe
1524	convert.exe
1524	convert.exe
1524	convert.exe
1524	convert.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
320	file.exe
3468	Explorer.EXE
3468	Explorer.EXE
1524	convert.exe
1524	convert.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1552	file.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3468	Explorer.EXE

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 320	1552	file.exe	84
PID 1552 wrote to memory of 320	1552	file.exe	84
PID 1552 wrote to memory of 320	1552	file.exe	84
PID 1552 wrote to memory of 320	1552	file.exe	84
PID 1552 wrote to memory of 320	1552	file.exe	84
PID 1552 wrote to memory of 320	1552	file.exe	84
PID 3468 wrote to memory of 1524	3468	Explorer.EXE	86
PID 3468 wrote to memory of 1524	3468	Explorer.EXE	86
PID 3468 wrote to memory of 1524	3468	Explorer.EXE	86

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1552
- - C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:320
- C:\Windows\SysWOW64\convert.exe
  "C:\Windows\SysWOW64\convert.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:1524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/320-11-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/320-23-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/320-24-0x0000000001460000-0x0000000001482000-memory.dmp

Filesize
136KB

Download
memory/320-19-0x0000000001460000-0x0000000001482000-memory.dmp

Filesize
136KB

Download
memory/320-18-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/320-17-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/320-16-0x0000000001500000-0x000000000184A000-memory.dmp

Filesize
3.3MB

Download
memory/320-15-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/320-13-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1524-25-0x0000000001120000-0x000000000146A000-memory.dmp

Filesize
3.3MB

Download
memory/1524-26-0x00000000008D0000-0x000000000090F000-memory.dmp

Filesize
252KB

Download
memory/1524-29-0x00000000008D0000-0x000000000090F000-memory.dmp

Filesize
252KB

Download
memory/1524-27-0x0000000001470000-0x0000000001511000-memory.dmp

Filesize
644KB

Download
memory/1524-22-0x00000000008D0000-0x000000000090F000-memory.dmp

Filesize
252KB

Download
memory/1524-21-0x00000000008D0000-0x000000000090F000-memory.dmp

Filesize
252KB

Download
memory/1552-9-0x00000000068F0000-0x000000000697A000-memory.dmp

Filesize
552KB

Download
memory/1552-5-0x0000000074A00000-0x00000000751B0000-memory.dmp

Filesize
7.7MB

Download
memory/1552-4-0x0000000005500000-0x000000000550A000-memory.dmp

Filesize
40KB

Download
memory/1552-3-0x0000000005520000-0x00000000055B2000-memory.dmp

Filesize
584KB

Download
memory/1552-6-0x0000000005790000-0x00000000057A2000-memory.dmp

Filesize
72KB

Download
memory/1552-7-0x0000000005A70000-0x0000000005A78000-memory.dmp

Filesize
32KB

Download
memory/1552-14-0x0000000074A00000-0x00000000751B0000-memory.dmp

Filesize
7.7MB

Download
memory/1552-2-0x0000000005AD0000-0x0000000006074000-memory.dmp

Filesize
5.6MB

Download
memory/1552-1-0x0000000000A40000-0x0000000000B10000-memory.dmp

Filesize
832KB

Download
memory/1552-0-0x0000000074A0E000-0x0000000074A0F000-memory.dmp

Filesize
4KB

Download
memory/1552-10-0x0000000008F50000-0x0000000008FEC000-memory.dmp

Filesize
624KB

Download
memory/1552-8-0x0000000005A80000-0x0000000005A8E000-memory.dmp

Filesize
56KB

Download
memory/3468-20-0x000000000D5A0000-0x000000000DF1B000-memory.dmp

Filesize
9.5MB

Download
memory/3468-28-0x000000000D5A0000-0x000000000DF1B000-memory.dmp

Filesize
9.5MB

Download
memory/3468-30-0x00000000030C0000-0x000000000316B000-memory.dmp

Filesize
684KB

Download
memory/3468-31-0x00000000030C0000-0x000000000316B000-memory.dmp

Filesize
684KB

Download
memory/3468-32-0x00000000030C0000-0x000000000316B000-memory.dmp

Filesize
684KB

Download