96c7d1d5dab0c8060f3220816e3e49461ef328643d520545ffc8aa05ddd76760

Analysis

max time kernel
11s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2024, 07:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96c7d1d5dab0c8060f3220816e3e49461ef328643d520545ffc8aa05ddd76760.exe
Size

1.6MB
MD5

3e4461418de7a12e7951ccf51fe4d4d3
SHA1

d7332419080c1a8eaef111439feb71bda300a1d3
SHA256

96c7d1d5dab0c8060f3220816e3e49461ef328643d520545ffc8aa05ddd76760
SHA512

b01982718c3f62059f086c3274f9f8d1c98bbb9bcc187bfa466b369d08818cd2fe06e0949256eddbfd6f26b3fd5428ea8008d49adf6f233282f08c8dce4e9553
SSDEEP

24576:9sRgQPPLVkiouiRjaMkVRu9JS70cJscGh6U8mEGKacNpVAADNi5GeZTOjo:9sV3LGjpkVIJunw98mTKfVAyNioSTO

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3564 created 3484	3564	96c7d1d5dab0c8060f3220816e3e49461ef328643d520545ffc8aa05ddd76760.exe	56

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FailedAssemblyInfo.vbs	96c7d1d5dab0c8060f3220816e3e49461ef328643d520545ffc8aa05ddd76760.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3564 set thread context of 1180	3564	96c7d1d5dab0c8060f3220816e3e49461ef328643d520545ffc8aa05ddd76760.exe	83

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3564	96c7d1d5dab0c8060f3220816e3e49461ef328643d520545ffc8aa05ddd76760.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3564	96c7d1d5dab0c8060f3220816e3e49461ef328643d520545ffc8aa05ddd76760.exe
Token: SeDebugPrivilege	3564	96c7d1d5dab0c8060f3220816e3e49461ef328643d520545ffc8aa05ddd76760.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 1180	3564	96c7d1d5dab0c8060f3220816e3e49461ef328643d520545ffc8aa05ddd76760.exe	83
PID 3564 wrote to memory of 1180	3564	96c7d1d5dab0c8060f3220816e3e49461ef328643d520545ffc8aa05ddd76760.exe	83
PID 3564 wrote to memory of 1180	3564	96c7d1d5dab0c8060f3220816e3e49461ef328643d520545ffc8aa05ddd76760.exe	83
PID 3564 wrote to memory of 1180	3564	96c7d1d5dab0c8060f3220816e3e49461ef328643d520545ffc8aa05ddd76760.exe	83
PID 3564 wrote to memory of 1180	3564	96c7d1d5dab0c8060f3220816e3e49461ef328643d520545ffc8aa05ddd76760.exe	83
PID 3564 wrote to memory of 1180	3564	96c7d1d5dab0c8060f3220816e3e49461ef328643d520545ffc8aa05ddd76760.exe	83

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3484
- C:\Users\Admin\AppData\Local\Temp\96c7d1d5dab0c8060f3220816e3e49461ef328643d520545ffc8aa05ddd76760.exe
  "C:\Users\Admin\AppData\Local\Temp\96c7d1d5dab0c8060f3220816e3e49461ef328643d520545ffc8aa05ddd76760.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Drops startup file
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3564
- C:\Users\Admin\AppData\Local\Temp\96c7d1d5dab0c8060f3220816e3e49461ef328643d520545ffc8aa05ddd76760.exe
  "C:\Users\Admin\AppData\Local\Temp\96c7d1d5dab0c8060f3220816e3e49461ef328643d520545ffc8aa05ddd76760.exe"
  2⤵
  PID:1180
- C:\Users\Admin\AppData\Roaming\Access\InnerException.exe
  "C:\Users\Admin\AppData\Roaming\Access\InnerException.exe"
  2⤵
  PID:2816
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe
    3⤵
    PID:2504
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe"
  2⤵
  PID:3172
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u KAS:kaspa:qqjn2sfatk0dmj0x47yns4xlyp3avwp46mhum864y5kc3hcrajwy7v5npvpn8.RIG_CPU -p x --cpu-max-threads-hint=50
    3⤵
    PID:4704

C:\Users\Admin\AppData\Roaming\Access\InnerException.exe
C:\Users\Admin\AppData\Roaming\Access\InnerException.exe
1⤵
PID:2168

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Access\InnerException.exe

Filesize
1.6MB

MD5
3e4461418de7a12e7951ccf51fe4d4d3

SHA1
d7332419080c1a8eaef111439feb71bda300a1d3

SHA256
96c7d1d5dab0c8060f3220816e3e49461ef328643d520545ffc8aa05ddd76760

SHA512
b01982718c3f62059f086c3274f9f8d1c98bbb9bcc187bfa466b369d08818cd2fe06e0949256eddbfd6f26b3fd5428ea8008d49adf6f233282f08c8dce4e9553

Download Submit
memory/1180-1169-0x0000021AD8760000-0x0000021AD8768000-memory.dmp

Filesize
32KB

Download
memory/1180-5151-0x00007FFA20CC0000-0x00007FFA21781000-memory.dmp

Filesize
10.8MB

Download
memory/1180-5147-0x0000021AF10D0000-0x0000021AF1126000-memory.dmp

Filesize
344KB

Download
memory/1180-1171-0x0000021AF1160000-0x0000021AF126A000-memory.dmp

Filesize
1.0MB

Download
memory/1180-1172-0x00007FFA20CC0000-0x00007FFA21781000-memory.dmp

Filesize
10.8MB

Download
memory/1180-1170-0x00007FFA20CC0000-0x00007FFA21781000-memory.dmp

Filesize
10.8MB

Download
memory/1180-1166-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/2168-6314-0x00007FFA20780000-0x00007FFA21241000-memory.dmp

Filesize
10.8MB

Download
memory/2168-6306-0x00007FFA20780000-0x00007FFA21241000-memory.dmp

Filesize
10.8MB

Download
memory/2168-5155-0x00007FFA20780000-0x00007FFA21241000-memory.dmp

Filesize
10.8MB

Download
memory/2168-5154-0x00007FFA20780000-0x00007FFA21241000-memory.dmp

Filesize
10.8MB

Download
memory/3564-8-0x000002F65BD00000-0x000002F65BE99000-memory.dmp

Filesize
1.6MB

Download
memory/3564-10-0x000002F65BD00000-0x000002F65BE99000-memory.dmp

Filesize
1.6MB

Download
memory/3564-40-0x000002F65BD00000-0x000002F65BE99000-memory.dmp

Filesize
1.6MB

Download
memory/3564-38-0x000002F65BD00000-0x000002F65BE99000-memory.dmp

Filesize
1.6MB

Download
memory/3564-34-0x000002F65BD00000-0x000002F65BE99000-memory.dmp

Filesize
1.6MB

Download
memory/3564-32-0x000002F65BD00000-0x000002F65BE99000-memory.dmp

Filesize
1.6MB

Download
memory/3564-31-0x000002F65BD00000-0x000002F65BE99000-memory.dmp

Filesize
1.6MB

Download
memory/3564-28-0x000002F65BD00000-0x000002F65BE99000-memory.dmp

Filesize
1.6MB

Download
memory/3564-26-0x000002F65BD00000-0x000002F65BE99000-memory.dmp

Filesize
1.6MB

Download
memory/3564-24-0x000002F65BD00000-0x000002F65BE99000-memory.dmp

Filesize
1.6MB

Download
memory/3564-23-0x000002F65BD00000-0x000002F65BE99000-memory.dmp

Filesize
1.6MB

Download
memory/3564-20-0x000002F65BD00000-0x000002F65BE99000-memory.dmp

Filesize
1.6MB

Download
memory/3564-18-0x000002F65BD00000-0x000002F65BE99000-memory.dmp

Filesize
1.6MB

Download
memory/3564-16-0x000002F65BD00000-0x000002F65BE99000-memory.dmp

Filesize
1.6MB

Download
memory/3564-14-0x000002F65BD00000-0x000002F65BE99000-memory.dmp

Filesize
1.6MB

Download
memory/3564-12-0x000002F65BD00000-0x000002F65BE99000-memory.dmp

Filesize
1.6MB

Download
memory/3564-0-0x00007FFA20CC3000-0x00007FFA20CC5000-memory.dmp

Filesize
8KB

Download
memory/3564-6-0x000002F65BD00000-0x000002F65BE99000-memory.dmp

Filesize
1.6MB

Download
memory/3564-4-0x000002F65BD00000-0x000002F65BE99000-memory.dmp

Filesize
1.6MB

Download
memory/3564-3-0x000002F65BD00000-0x000002F65BE99000-memory.dmp

Filesize
1.6MB

Download
memory/3564-36-0x000002F65BD00000-0x000002F65BE99000-memory.dmp

Filesize
1.6MB

Download
memory/3564-41-0x00007FFA20CC0000-0x00007FFA21781000-memory.dmp

Filesize
10.8MB

Download
memory/3564-63-0x000002F65BD00000-0x000002F65BE99000-memory.dmp

Filesize
1.6MB

Download
memory/3564-61-0x000002F65BD00000-0x000002F65BE99000-memory.dmp

Filesize
1.6MB

Download
memory/3564-55-0x000002F65BD00000-0x000002F65BE99000-memory.dmp

Filesize
1.6MB

Download
memory/3564-1154-0x00007FFA20CC0000-0x00007FFA21781000-memory.dmp

Filesize
10.8MB

Download
memory/3564-1155-0x000002F65BEA0000-0x000002F65BFAE000-memory.dmp

Filesize
1.1MB

Download
memory/3564-1156-0x000002F643490000-0x000002F6434DC000-memory.dmp

Filesize
304KB

Download
memory/3564-1157-0x000002F65BC30000-0x000002F65BC84000-memory.dmp

Filesize
336KB

Download
memory/3564-1161-0x00007FFA20CC0000-0x00007FFA21781000-memory.dmp

Filesize
10.8MB

Download
memory/3564-43-0x000002F65BD00000-0x000002F65BE99000-memory.dmp

Filesize
1.6MB

Download
memory/3564-1168-0x00007FFA20CC0000-0x00007FFA21781000-memory.dmp

Filesize
10.8MB

Download
memory/3564-1167-0x00007FFA20CC0000-0x00007FFA21781000-memory.dmp

Filesize
10.8MB

Download
memory/3564-45-0x000002F65BD00000-0x000002F65BE99000-memory.dmp

Filesize
1.6MB

Download
memory/3564-47-0x000002F65BD00000-0x000002F65BE99000-memory.dmp

Filesize
1.6MB

Download
memory/3564-49-0x000002F65BD00000-0x000002F65BE99000-memory.dmp

Filesize
1.6MB

Download
memory/3564-51-0x000002F65BD00000-0x000002F65BE99000-memory.dmp

Filesize
1.6MB

Download
memory/3564-57-0x000002F65BD00000-0x000002F65BE99000-memory.dmp

Filesize
1.6MB

Download
memory/3564-59-0x000002F65BD00000-0x000002F65BE99000-memory.dmp

Filesize
1.6MB

Download
memory/3564-65-0x000002F65BD00000-0x000002F65BE99000-memory.dmp

Filesize
1.6MB

Download
memory/3564-67-0x000002F65BD00000-0x000002F65BE99000-memory.dmp

Filesize
1.6MB

Download
memory/3564-53-0x000002F65BD00000-0x000002F65BE99000-memory.dmp

Filesize
1.6MB

Download
memory/3564-2-0x000002F65BD00000-0x000002F65BEA0000-memory.dmp

Filesize
1.6MB

Download
memory/3564-1-0x000002F6415D0000-0x000002F64176E000-memory.dmp

Filesize
1.6MB

Download