0347cebe09dcadf49e0472633e9be579f0e1fbbb995bb8ecb226588bff3e1d2c | Triage

Resubmissions

22/08/2024, 22:17

240822-17cpsashrq 3

22/08/2024, 22:14

240822-15pxbs1alf 3

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2024, 22:14

Sharing

Report Analysis Logs

General

Target

porn.exe
Size

1.4MB
MD5

23ae8a019fcc2c7121039a875337ec12
SHA1

5e7931ab65d93e51bd456f1af40e4565f6d9ef8d
SHA256

0347cebe09dcadf49e0472633e9be579f0e1fbbb995bb8ecb226588bff3e1d2c
SHA512

5d6f96d98e47fc37e0cacab29770b9b11c3495d9d95072c042c52abaafe6fe5defbacb8e419af9d39fd758fa3e12c852f88e20484a88fe7d47cc889d26454699
SSDEEP

24576:E6qsgabtl9T8Nx6AQ8DSoRPm/Rwn4o60OegX7Aozptl72NkoV:is9bnuNzv+DenO0Ervzd2Nkw

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3488	porn.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 920	3488	porn.exe	84
PID 3488 wrote to memory of 920	3488	porn.exe	84
PID 920 wrote to memory of 2920	920	cmd.exe	86
PID 920 wrote to memory of 2920	920	cmd.exe	86
PID 920 wrote to memory of 404	920	cmd.exe	87
PID 920 wrote to memory of 404	920	cmd.exe	87
PID 920 wrote to memory of 3616	920	cmd.exe	88
PID 920 wrote to memory of 3616	920	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\porn.exe
"C:\Users\Admin\AppData\Local\Temp\porn.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\porn.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:920
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\porn.exe" MD5
    3⤵
    PID:2920
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:404
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:3616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads