aa8c290181a84955417dd9d3535d5941999d035a308742775c3096f1e20ea187

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 23:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Setup.exe
Size

12.0MB
MD5

a7118dffeac3772076f1a39a364d608d
SHA1

6b984d9446f23579e154ec47437b9cf820fd6b67
SHA256

f1973746ac0a703b23526f68c639436f0b26b0bc71c4f5adf36dc5f6e8a7f4d0
SHA512

f547c13b78acda9ca0523f0f8cd966c906f70a23a266ac86156dc7e17e6349e5f506366787e7a7823e2b07b0d614c9bd08e34ca5cc4f48799b0fe36ac836e890
SSDEEP

98304:ReAtQzKADvk/9TEaImN9/tiHBIn8c3hCEFRUTaZnPZOtXwH:ReAOWOM/FE1mNHiFc3hr7UTaZnhOtXwH

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2372 set thread context of 2688	2372	Setup.exe	30

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2372	Setup.exe
2372	Setup.exe
2688	cmd.exe
2688	cmd.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2372	Setup.exe
2688	cmd.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2688	2372	Setup.exe	30
PID 2372 wrote to memory of 2688	2372	Setup.exe	30
PID 2372 wrote to memory of 2688	2372	Setup.exe	30
PID 2372 wrote to memory of 2688	2372	Setup.exe	30
PID 2372 wrote to memory of 2688	2372	Setup.exe	30
PID 2688 wrote to memory of 2780	2688	cmd.exe	32
PID 2688 wrote to memory of 2780	2688	cmd.exe	32
PID 2688 wrote to memory of 2780	2688	cmd.exe	32
PID 2688 wrote to memory of 2780	2688	cmd.exe	32
PID 2688 wrote to memory of 2780	2688	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    PID:2780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2ff153fd

Filesize
1008KB

MD5
d4ae9da2a3813f7c05b712d611155a74

SHA1
bfd5718cdeb8427705c38de94ed36b3c3726308b

SHA256
8162b3e3af99f454125f832c0799bb2598d4500530b126e16e43d8db29990150

SHA512
7673ef202a18a0e44cae59747cd0cf869ab971f82f5e821c862f2b5f07ab479b027f8a837876df62a4116a58bf54fd02d0568a59773c9faf872f44279c9ac093

Download Submit
memory/2372-0-0x000007FEF72A0000-0x000007FEF73F8000-memory.dmp

Filesize
1.3MB

Download
memory/2372-4-0x000007FEF72B8000-0x000007FEF72B9000-memory.dmp

Filesize
4KB

Download
memory/2372-5-0x000007FEF72A0000-0x000007FEF73F8000-memory.dmp

Filesize
1.3MB

Download
memory/2372-6-0x000007FEF72A0000-0x000007FEF73F8000-memory.dmp

Filesize
1.3MB

Download
memory/2372-8-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2688-12-0x000000007496E000-0x0000000074970000-memory.dmp

Filesize
8KB

Download
memory/2688-11-0x0000000074960000-0x0000000074AD4000-memory.dmp

Filesize
1.5MB

Download
memory/2688-10-0x0000000076FC0000-0x0000000077169000-memory.dmp

Filesize
1.7MB

Download
memory/2688-13-0x0000000074960000-0x0000000074AD4000-memory.dmp

Filesize
1.5MB

Download
memory/2688-15-0x0000000074960000-0x0000000074AD4000-memory.dmp

Filesize
1.5MB

Download
memory/2688-20-0x000000007496E000-0x0000000074970000-memory.dmp

Filesize
8KB

Download
memory/2780-16-0x0000000076FC0000-0x0000000077169000-memory.dmp

Filesize
1.7MB

Download
memory/2780-17-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2780-18-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2780-19-0x00000000009E0000-0x00000000009E8000-memory.dmp

Filesize
32KB

Download