Analysis

  • max time kernel
    98s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/11/2024, 09:41

General

  • Target

    d7146b7c63fb5dce714b91fc4690a1e885ee011d406a2e02d6ff80b3f53ae214.exe

  • Size

    1.1MB

  • MD5

    7ec247215d29c504b94a57df1ae09b1b

  • SHA1

    9c9627dae07b2f0b6d192bb72e2a86e166d3a695

  • SHA256

    d7146b7c63fb5dce714b91fc4690a1e885ee011d406a2e02d6ff80b3f53ae214

  • SHA512

    627e7caf1abbcfbccf6d5c6d48bf1aff714524df1a977e90f6fa8610340b0c3fd1993c898d4376651b624a7039c23a22dd9b0e4cff08946ca2adb7ed9bdfa4fb

  • SSDEEP

    12288:r7YDR8uxNBZPzLxvYbgqsI/Cu5447Ymn1wE2N7BXzXhm+d8R3OkMJsDrZAkt1vUZ:r7KJhQuW4qn1wEYXzRPd8RVXhRq0dGm

Score
6/10

Malware Config

Signatures

  • Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d7146b7c63fb5dce714b91fc4690a1e885ee011d406a2e02d6ff80b3f53ae214.exe
    "C:\Users\Admin\AppData\Local\Temp\d7146b7c63fb5dce714b91fc4690a1e885ee011d406a2e02d6ff80b3f53ae214.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4032
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      2⤵
        PID:4120
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        2⤵
        • Accesses Microsoft Outlook profiles
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:228

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/228-55-0x0000000004EC0000-0x0000000004F57000-memory.dmp

            Filesize

            604KB

          • memory/228-19-0x0000000004EC0000-0x0000000004F57000-memory.dmp

            Filesize

            604KB

          • memory/228-7954-0x0000000074D20000-0x00000000754D0000-memory.dmp

            Filesize

            7.7MB

          • memory/228-7952-0x0000000074D20000-0x00000000754D0000-memory.dmp

            Filesize

            7.7MB

          • memory/228-7951-0x0000000006760000-0x00000000067B0000-memory.dmp

            Filesize

            320KB

          • memory/228-7950-0x0000000005F50000-0x0000000005F62000-memory.dmp

            Filesize

            72KB

          • memory/228-7949-0x0000000005560000-0x00000000055C6000-memory.dmp

            Filesize

            408KB

          • memory/228-4529-0x0000000074D20000-0x00000000754D0000-memory.dmp

            Filesize

            7.7MB

          • memory/228-2927-0x0000000005400000-0x00000000054F2000-memory.dmp

            Filesize

            968KB

          • memory/228-2925-0x0000000004F90000-0x0000000004FBC000-memory.dmp

            Filesize

            176KB

          • memory/228-2926-0x0000000005070000-0x00000000050BC000-memory.dmp

            Filesize

            304KB

          • memory/228-33-0x0000000004EC0000-0x0000000004F57000-memory.dmp

            Filesize

            604KB

          • memory/228-43-0x0000000004EC0000-0x0000000004F57000-memory.dmp

            Filesize

            604KB

          • memory/228-13-0x0000000000400000-0x0000000000470000-memory.dmp

            Filesize

            448KB

          • memory/228-53-0x0000000004EC0000-0x0000000004F57000-memory.dmp

            Filesize

            604KB

          • memory/228-16-0x0000000004EC0000-0x0000000004F5C000-memory.dmp

            Filesize

            624KB

          • memory/228-73-0x0000000004EC0000-0x0000000004F57000-memory.dmp

            Filesize

            604KB

          • memory/228-79-0x0000000004EC0000-0x0000000004F57000-memory.dmp

            Filesize

            604KB

          • memory/228-77-0x0000000004EC0000-0x0000000004F57000-memory.dmp

            Filesize

            604KB

          • memory/228-75-0x0000000004EC0000-0x0000000004F57000-memory.dmp

            Filesize

            604KB

          • memory/228-71-0x0000000004EC0000-0x0000000004F57000-memory.dmp

            Filesize

            604KB

          • memory/228-69-0x0000000004EC0000-0x0000000004F57000-memory.dmp

            Filesize

            604KB

          • memory/228-67-0x0000000004EC0000-0x0000000004F57000-memory.dmp

            Filesize

            604KB

          • memory/228-63-0x0000000004EC0000-0x0000000004F57000-memory.dmp

            Filesize

            604KB

          • memory/228-183-0x0000000074D20000-0x00000000754D0000-memory.dmp

            Filesize

            7.7MB

          • memory/228-61-0x0000000004EC0000-0x0000000004F57000-memory.dmp

            Filesize

            604KB

          • memory/228-59-0x0000000004EC0000-0x0000000004F57000-memory.dmp

            Filesize

            604KB

          • memory/228-57-0x0000000004EC0000-0x0000000004F57000-memory.dmp

            Filesize

            604KB

          • memory/228-65-0x0000000004EC0000-0x0000000004F57000-memory.dmp

            Filesize

            604KB

          • memory/228-25-0x0000000004EC0000-0x0000000004F57000-memory.dmp

            Filesize

            604KB

          • memory/228-17-0x0000000074D20000-0x00000000754D0000-memory.dmp

            Filesize

            7.7MB

          • memory/228-47-0x0000000004EC0000-0x0000000004F57000-memory.dmp

            Filesize

            604KB

          • memory/228-45-0x0000000004EC0000-0x0000000004F57000-memory.dmp

            Filesize

            604KB

          • memory/228-41-0x0000000004EC0000-0x0000000004F57000-memory.dmp

            Filesize

            604KB

          • memory/228-39-0x0000000004EC0000-0x0000000004F57000-memory.dmp

            Filesize

            604KB

          • memory/228-37-0x0000000004EC0000-0x0000000004F57000-memory.dmp

            Filesize

            604KB

          • memory/228-35-0x0000000004EC0000-0x0000000004F57000-memory.dmp

            Filesize

            604KB

          • memory/228-31-0x0000000004EC0000-0x0000000004F57000-memory.dmp

            Filesize

            604KB

          • memory/228-29-0x0000000004EC0000-0x0000000004F57000-memory.dmp

            Filesize

            604KB

          • memory/228-27-0x0000000004EC0000-0x0000000004F57000-memory.dmp

            Filesize

            604KB

          • memory/228-51-0x0000000004EC0000-0x0000000004F57000-memory.dmp

            Filesize

            604KB

          • memory/228-23-0x0000000004EC0000-0x0000000004F57000-memory.dmp

            Filesize

            604KB

          • memory/228-21-0x0000000004EC0000-0x0000000004F57000-memory.dmp

            Filesize

            604KB

          • memory/228-49-0x0000000004EC0000-0x0000000004F57000-memory.dmp

            Filesize

            604KB

          • memory/228-18-0x0000000004EC0000-0x0000000004F57000-memory.dmp

            Filesize

            604KB

          • memory/4032-6-0x0000000005370000-0x0000000005402000-memory.dmp

            Filesize

            584KB

          • memory/4032-3-0x0000000002A00000-0x0000000002A44000-memory.dmp

            Filesize

            272KB

          • memory/4032-15-0x0000000074D20000-0x00000000754D0000-memory.dmp

            Filesize

            7.7MB

          • memory/4032-12-0x0000000009560000-0x0000000009566000-memory.dmp

            Filesize

            24KB

          • memory/4032-11-0x0000000006820000-0x000000000683A000-memory.dmp

            Filesize

            104KB

          • memory/4032-0-0x0000000074D2E000-0x0000000074D2F000-memory.dmp

            Filesize

            4KB

          • memory/4032-7-0x0000000005330000-0x000000000533A000-memory.dmp

            Filesize

            40KB

          • memory/4032-8-0x0000000074D20000-0x00000000754D0000-memory.dmp

            Filesize

            7.7MB

          • memory/4032-1-0x0000000000890000-0x00000000009A8000-memory.dmp

            Filesize

            1.1MB

          • memory/4032-9-0x0000000074D2E000-0x0000000074D2F000-memory.dmp

            Filesize

            4KB

          • memory/4032-5-0x0000000005700000-0x0000000005CA4000-memory.dmp

            Filesize

            5.6MB

          • memory/4032-4-0x0000000074D20000-0x00000000754D0000-memory.dmp

            Filesize

            7.7MB

          • memory/4032-10-0x0000000074D20000-0x00000000754D0000-memory.dmp

            Filesize

            7.7MB

          • memory/4032-2-0x0000000004E40000-0x0000000004EDC000-memory.dmp

            Filesize

            624KB