Analysis
-
max time kernel
129s -
max time network
118s -
platform
windows10_x64 -
resource
win10 -
submitted
31-07-2020 09:59
General
-
Target
55a4729b40ed4f2aaccb3d59ddf80d95.exe
-
Size
151KB
-
MD5
55a4729b40ed4f2aaccb3d59ddf80d95
-
SHA1
c5cc028d488b4a348091528f3089d04dac432eaf
-
SHA256
7a245e07279488497a16ef86a6129b1bd8c72c18b37a2504bee743c528aab8da
-
SHA512
5e1afba9ccac1be8941e8e1204a1ccf5bf75f8d95b8574c13a11f0a628af7ec795be9bd2f1930b071f17016cc5af35e90e7f491c1c8e2505c4a3cb76670109cd
Score
8/10
Malware Config
Signatures
-
Drops file in Windows directory 5 IoCs
-
Program crash 10 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious behavior: EnumeratesProcesses 134 IoCs
-
Executes dropped EXE 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\55a4729b40ed4f2aaccb3d59ddf80d95.exe"C:\Users\Admin\AppData\Local\Temp\55a4729b40ed4f2aaccb3d59ddf80d95.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 5442⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 8562⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 8682⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\pqjgc\elcna.exeC:\ProgramData\pqjgc\elcna.exe start1⤵
- Drops file in Windows directory
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 412 -s 5362⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 412 -s 7162⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 412 -s 7242⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 412 -s 6882⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 412 -s 9322⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\TEMP\cgdbx.exeC:\Windows\TEMP\cgdbx.exe1⤵
- Drops file in Windows directory
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3208 -s 5362⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\iwup\ivxm.exeC:\ProgramData\iwup\ivxm.exe start1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 5402⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB413.tmp.WERInternalMetadata.xml
-
C:\ProgramData\iwup\ivxm.exe
-
C:\ProgramData\iwup\ivxm.exe
-
C:\ProgramData\pqjgc\elcna.exe
-
C:\ProgramData\pqjgc\elcna.exe
-
C:\Windows\TEMP\cgdbx.exe
-
C:\Windows\Tasks\elcna.job
-
C:\Windows\Temp\cgdbx.exe
-
memory/412-54-0x0000000003C60000-0x0000000003C61000-memory.dmpFilesize
4KB
-
memory/412-55-0x0000000003C60000-0x0000000003C61000-memory.dmpFilesize
4KB
-
memory/412-53-0x000000000343C000-0x000000000343D000-memory.dmpFilesize
4KB
-
memory/616-84-0x0000000003EE0000-0x0000000003EE1000-memory.dmpFilesize
4KB
-
memory/616-81-0x00000000037B0000-0x00000000037B1000-memory.dmpFilesize
4KB
-
memory/804-77-0x0000000004560000-0x0000000004561000-memory.dmpFilesize
4KB
-
memory/804-80-0x0000000004C90000-0x0000000004C91000-memory.dmpFilesize
4KB
-
memory/1208-88-0x00000000034D0000-0x00000000034D1000-memory.dmpFilesize
4KB
-
memory/1208-85-0x0000000002DA0000-0x0000000002DA1000-memory.dmpFilesize
4KB
-
memory/1888-95-0x0000000003990000-0x0000000003991000-memory.dmpFilesize
4KB
-
memory/1888-100-0x00000000041C0000-0x00000000041C1000-memory.dmpFilesize
4KB
-
memory/2060-63-0x0000000002F00000-0x0000000002F01000-memory.dmpFilesize
4KB
-
memory/2260-56-0x0000000003080000-0x0000000003081000-memory.dmpFilesize
4KB
-
memory/2260-60-0x0000000003870000-0x0000000003871000-memory.dmpFilesize
4KB
-
memory/2260-59-0x0000000003480000-0x0000000003481000-memory.dmpFilesize
4KB
-
memory/2824-107-0x0000000003910000-0x0000000003911000-memory.dmpFilesize
4KB
-
memory/2824-110-0x0000000004040000-0x0000000004041000-memory.dmpFilesize
4KB
-
memory/3208-91-0x000000000363C000-0x000000000363D000-memory.dmpFilesize
4KB
-
memory/3208-92-0x0000000003CF0000-0x0000000003CF1000-memory.dmpFilesize
4KB
-
memory/3560-94-0x0000000003550000-0x0000000003551000-memory.dmpFilesize
4KB
-
memory/3560-101-0x0000000003F10000-0x0000000003F11000-memory.dmpFilesize
4KB
-
memory/3588-1-0x00000000052E0000-0x00000000052E1000-memory.dmpFilesize
4KB
-
memory/3588-76-0x00000000053E0000-0x00000000053E1000-memory.dmpFilesize
4KB
-
memory/3588-0-0x0000000003361000-0x0000000003362000-memory.dmpFilesize
4KB
-
memory/3588-75-0x00000000053E0000-0x00000000053E1000-memory.dmpFilesize
4KB
-
memory/3728-71-0x0000000004980000-0x0000000004981000-memory.dmpFilesize
4KB
-
memory/3728-74-0x0000000004FC0000-0x0000000004FC1000-memory.dmpFilesize
4KB
-
memory/3824-6-0x00000000051C0000-0x00000000051C1000-memory.dmpFilesize
4KB
-
memory/3824-2-0x0000000004A90000-0x0000000004A91000-memory.dmpFilesize
4KB
-
memory/3824-3-0x0000000004A90000-0x0000000004A91000-memory.dmpFilesize
4KB
-
memory/3992-105-0x000000000344C000-0x000000000344D000-memory.dmpFilesize
4KB
-
memory/3992-106-0x0000000003CE0000-0x0000000003CE1000-memory.dmpFilesize
4KB