Analysis
- max time kernel
10s - max time network
70s - platform
windows10_x64 - resource
win10 - submitted
13/10/2020, 17:49
General
- Target Doc_99384837398765609876567.exe
- Size 293KB
- Sample201013-a9fwatklve
- SHA256 6166080f4a51f809c3b2d5e1e030750f696f27db8c8fc45046611ba02a04014e
Score
1/10
Malware Config
Signatures
- Delays execution with timeout.exe 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Doc_99384837398765609876567.exe"C:\Users\Admin\AppData\Local\Temp\Doc_99384837398765609876567.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 42⤵
- Delays execution with timeout.exe
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3864-0-0x0000000074070000-0x000000007475E000-memory.dmp
memory/3864-1-0x0000000000AC0000-0x0000000000AC1000-memory.dmp
memory/3864-2-0x0000000005390000-0x0000000005391000-memory.dmp
memory/3864-4-0x0000000005D70000-0x0000000005DE7000-memory.dmp
memory/3864-5-0x00000000063C0000-0x00000000063C1000-memory.dmp
memory/3864-8-0x0000000005F20000-0x0000000005F21000-memory.dmp
memory/3864-9-0x0000000005E80000-0x0000000005E81000-memory.dmp