cb2757792673b5b344336c6be45e855b1674826c435d1257434d3df434a0627b

Resubmissions

14/09/2024, 02:42

240914-c7fvfasglp 8

14/09/2024, 02:37

240914-c4gmkaseqn 7

Analysis

max time kernel
121s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/09/2024, 02:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Installer.exe
Size

120.4MB
MD5

36d0b5b1ed9a76523d7279752d995b9a
SHA1

a555ca2f60a5c80b145c5405002fa3e1b29268a8
SHA256

fc3146019e85fad7a1d2e2049fc7c45105d3cd337d2531967829103d87fe6bb3
SHA512

bd1312889a51dbf716001084a972bdbfbb0c44260adcb54c593bef078a394bc494dbc34a8a87a6d908674745c85d27fd9fe1c44f56636f8e60190ddf88bae3c9
SSDEEP

1572864:a1f0+Sva7Hdp1Nhn+aCdrvdYrZ/7/lbg8udR8SnuSE49z:3asulbg8yTnbEOz

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3688	Installer.exe
3688	Installer.exe
3544	Installer.exe
3544	Installer.exe
3544	Installer.exe
3544	Installer.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 1132	1776	Installer.exe	92
PID 1776 wrote to memory of 1132	1776	Installer.exe	92
PID 1776 wrote to memory of 1132	1776	Installer.exe	92
PID 1776 wrote to memory of 1132	1776	Installer.exe	92
PID 1776 wrote to memory of 1132	1776	Installer.exe	92
PID 1776 wrote to memory of 1132	1776	Installer.exe	92
PID 1776 wrote to memory of 1132	1776	Installer.exe	92
PID 1776 wrote to memory of 1132	1776	Installer.exe	92
PID 1776 wrote to memory of 1132	1776	Installer.exe	92
PID 1776 wrote to memory of 1132	1776	Installer.exe	92
PID 1776 wrote to memory of 1132	1776	Installer.exe	92
PID 1776 wrote to memory of 1132	1776	Installer.exe	92
PID 1776 wrote to memory of 1132	1776	Installer.exe	92
PID 1776 wrote to memory of 1132	1776	Installer.exe	92
PID 1776 wrote to memory of 1132	1776	Installer.exe	92
PID 1776 wrote to memory of 1132	1776	Installer.exe	92
PID 1776 wrote to memory of 1132	1776	Installer.exe	92
PID 1776 wrote to memory of 1132	1776	Installer.exe	92
PID 1776 wrote to memory of 1132	1776	Installer.exe	92
PID 1776 wrote to memory of 1132	1776	Installer.exe	92
PID 1776 wrote to memory of 1132	1776	Installer.exe	92
PID 1776 wrote to memory of 1132	1776	Installer.exe	92
PID 1776 wrote to memory of 1132	1776	Installer.exe	92
PID 1776 wrote to memory of 1132	1776	Installer.exe	92
PID 1776 wrote to memory of 1132	1776	Installer.exe	92
PID 1776 wrote to memory of 1132	1776	Installer.exe	92
PID 1776 wrote to memory of 1132	1776	Installer.exe	92
PID 1776 wrote to memory of 1132	1776	Installer.exe	92
PID 1776 wrote to memory of 1132	1776	Installer.exe	92
PID 1776 wrote to memory of 1132	1776	Installer.exe	92
PID 1776 wrote to memory of 1132	1776	Installer.exe	92
PID 1776 wrote to memory of 1132	1776	Installer.exe	92
PID 1776 wrote to memory of 1132	1776	Installer.exe	92
PID 1776 wrote to memory of 1132	1776	Installer.exe	92
PID 1776 wrote to memory of 1132	1776	Installer.exe	92
PID 1776 wrote to memory of 1132	1776	Installer.exe	92
PID 1776 wrote to memory of 1132	1776	Installer.exe	92
PID 1776 wrote to memory of 1132	1776	Installer.exe	92
PID 1776 wrote to memory of 1132	1776	Installer.exe	92
PID 1776 wrote to memory of 1132	1776	Installer.exe	92
PID 1776 wrote to memory of 3688	1776	Installer.exe	93
PID 1776 wrote to memory of 3688	1776	Installer.exe	93
PID 1776 wrote to memory of 3544	1776	Installer.exe	104
PID 1776 wrote to memory of 3544	1776	Installer.exe	104

C:\Users\Admin\AppData\Local\Temp\Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Installer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Users\Admin\AppData\Local\Temp\Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\Installer.exe" --type=gpu-process --field-trial-handle=1668,14828361668687770347,15370677278567944896,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1680 /prefetch:2
  2⤵
  PID:1132
- C:\Users\Admin\AppData\Local\Temp\Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\Installer.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1668,14828361668687770347,15370677278567944896,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2008 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3688
- C:\Users\Admin\AppData\Local\Temp\Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\Installer.exe" --type=gpu-process --field-trial-handle=1668,14828361668687770347,15370677278567944896,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=MAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAIAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1224 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4628,i,16315016104747277319,5510969007830467313,262144 --variations-seed-version --mojo-platform-channel-handle=4060 /prefetch:8
1⤵
PID:2564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1132-2-0x00007FF964630000-0x00007FF964631000-memory.dmp

Filesize
4KB

Download