6c66a530ffba5d13f757de65d3fe08968aad8df9b1f03f6876f631d0dd28f10e | Triage

Analysis

max time kernel
115s
max time network
120s
platform
windows7_x64
resource
win7
submitted
10-07-2020 12:11

Sharing

Report Analysis Logs

General

Target

SecuriteInfo.com.Variant.Ulise.108894.12225.10849.exe
Size

2.2MB
MD5

5a68b66d118f10560485e42ff141487c
SHA1

8e0ea69493ca842fb2d3fa3e2ef9be1ea2467e4b
SHA256

6c66a530ffba5d13f757de65d3fe08968aad8df9b1f03f6876f631d0dd28f10e
SHA512

256cda6900929c32cabe0436aa15db8e3eb79c8c12eff8049845f6f854ae3a49c407909c463cce125a74a5c8a6eedd7b88c3ff56cef7e6846c5d5ef048139992

Score

3^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 1068	1156	SecuriteInfo.com.Variant.Ulise.108894.12225.10849.exe	24
PID 1156 wrote to memory of 1068	1156	SecuriteInfo.com.Variant.Ulise.108894.12225.10849.exe	24
PID 1156 wrote to memory of 1068	1156	SecuriteInfo.com.Variant.Ulise.108894.12225.10849.exe	24
PID 1156 wrote to memory of 1068	1156	SecuriteInfo.com.Variant.Ulise.108894.12225.10849.exe	24

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1068	WerFault.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1068	WerFault.exe
1068	WerFault.exe
1068	WerFault.exe
1068	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1068	1156	WerFault.exe	23

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Ulise.108894.12225.10849.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Ulise.108894.12225.10849.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1156 -s 36
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Program crash
  PID:1068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1068-1-0x0000000001E40000-0x0000000001E51000-memory.dmp

Filesize
68KB

Download
memory/1068-2-0x0000000001E40000-0x0000000001E51000-memory.dmp

Filesize
68KB

Download
memory/1068-4-0x00000000024F0000-0x0000000002501000-memory.dmp

Filesize
68KB

Download